Implements Authorization

.github/workflows/linting.yaml

@@ -11,7 +11,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "lts/hydrogen"
+          node-version-file: "package.json"
 
       - run: npm ci
 
@@ -24,7 +24,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "lts/hydrogen"
+          node-version-file: "package.json"
 
       - run: npm ci
 
@@ -39,7 +39,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "lts/hydrogen"
+          node-version-file: "package.json"
 
       - run: npm ci
 

.github/workflows/tests.yaml

@@ -11,7 +11,7 @@ jobs:
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "lts/hydrogen"
+          node-version-file: "package.json"
 
       - run: npm ci
 

.nvmrc

@@ -1 +1 @@
-lts/hydrogen
+24

infra/controller.js

@@ -1,11 +1,14 @@
 import * as cookie from "cookie";
 import session from "models/session.js";
+import user from "models/user.js";
+import authorization from "models/authorization.js";
 import {
   InternalServerError,
   MethodNotAllowedError,
   ValidationError,
   NotFoundError,
   UnauthorizedError,
+  ForbiddenError,
 } from "infra/errors";
 
 function onNoMatchHandler(request, response) {
@@ -14,7 +17,11 @@ function onNoMatchHandler(request, response) {
 }
 
 function onErrorHandler(error, request, response) {
-  if (error instanceof ValidationError || error instanceof NotFoundError) {
+  if (
+    error instanceof ValidationError ||
+    error instanceof NotFoundError ||
+    error instanceof ForbiddenError
+  ) {
     return response.status(error.statusCode).json(error);
   }
 
@@ -54,13 +61,62 @@ async function clearSessionCookie(response) {
   response.setHeader("Set-Cookie", setCookie);
 }
 
+async function injectAnonymousOrUser(request, response, next) {
+  if (request.cookies?.session_id) {
+    await injectAuthenticatedUser(request);
+  } else {
+    injectAnonymousUser(request);
+  }
+
+  return next();
+}
+
+async function injectAuthenticatedUser(request) {
+  const sessionToken = request.cookies.session_id;
+  const sessionObject = await session.findOneValidByToken(sessionToken);
+  const userObject = await user.findOneById(sessionObject.user_id);
+
+  request.context = {
+    ...request.context,
+    user: userObject,
+  };
+}
+
+function injectAnonymousUser(request) {
+  const anonymousUserObject = {
+    features: ["read:activation_token", "create:session", "create:user"],
+  };
+
+  request.context = {
+    ...request.context,
+    user: anonymousUserObject,
+  };
+}
+
+function canRequest(feature) {
+  return function canRequestMiddleware(request, response, next) {
+    const userTryingToRequest = request.context.user;
+
+    if (authorization.can(userTryingToRequest, feature)) {
+      return next();
+    }
+
+    throw new ForbiddenError({
+      message: "You do not have permission to execute this action.",
+      action: `Check if your user has the feature "${feature}"`,
+    });
+  };
+}
+
 const controller = {
   errorHandlers: {
     onNoMatch: onNoMatchHandler,
     onError: onErrorHandler,
   },
   setSessionCookie,
   clearSessionCookie,
+  injectAnonymousOrUser,
+  canRequest,
 };
 
 export default controller;

infra/email.js

@@ -1,4 +1,5 @@
 import nodemailer from "nodemailer";
+import { ServiceError } from "./errors.js";
 
 const transporter = nodemailer.createTransport({
   host: process.env.EMAIL_SMTP_HOST,
@@ -11,7 +12,16 @@ const transporter = nodemailer.createTransport({
 });
 
 async function send(mailOptions) {
-  await transporter.sendMail(mailOptions);
+  try {
+    await transporter.sendMail(mailOptions);
+  } catch (error) {
+    throw new ServiceError({
+      message: "It was not possible to send the email.",
+      action: "Check if the email service is avaiable.",
+      cause: error,
+      context: mailOptions,
+    });
+  }
 }
 
 const email = {

infra/errors.js

@@ -39,14 +39,15 @@ export class MethodNotAllowedError extends Error {
 }
 
 export class ServiceError extends Error {
-  constructor({ cause, message }) {
+  constructor({ cause, message, action, context }) {
     super(message || "Service unavailable.", {
       cause,
     });
 
     this.name = "ServiceError";
-    this.action = "Check if the service is available.";
+    this.action = action || "Check if the service is available.";
     this.statusCode = 503;
+    this.context = context;
   }
 
   toJSON() {
@@ -55,6 +56,7 @@ export class ServiceError extends Error {
       message: this.message,
       action: this.action,
       status_code: this.statusCode,
+      context: this.context,
     };
   }
 }
@@ -79,6 +81,27 @@ export class ValidationError extends Error {
   }
 }
 
+export class ForbiddenError extends Error {
+  constructor({ cause, message, action }) {
+    super(message || "Access Denied", {
+      cause,
+    });
+
+    this.name = "ForbiddenError";
+    this.action = action || "Check require features before continue.";
+    this.statusCode = 403;
+  }
+
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      action: this.action,
+      status_code: this.statusCode,
+    };
+  }
+}
+
 export class UnauthorizedError extends Error {
   constructor({ cause, message, action }) {
     super(message || "User not authenticated", {

infra/migrations/1784806098046_add-features-to-users.js

@@ -0,0 +1,11 @@
+exports.up = (pgm) => {
+  pgm.addColumn("users", {
+    features: {
+      type: "varchar[]",
+      notNull: true,
+      default: "{}",
+    },
+  });
+};
+
+exports.down = false;

infra/migrations/1784902867996_create-user-activation-tokens.js

@@ -0,0 +1,38 @@
+exports.up = (pgm) => {
+  pgm.createTable("user_activation_tokens", {
+    id: {
+      type: "uuid",
+      primaryKey: true,
+      default: pgm.func("gen_random_uuid()"),
+    },
+
+    used_at: {
+      type: "timestamptz",
+      notNull: false,
+    },
+
+    user_id: {
+      type: "uuid",
+      notNull: true,
+    },
+
+    expires_at: {
+      type: "timestamptz",
+      notNull: true,
+    },
+
+    created_at: {
+      type: "timestamptz",
+      notNull: true,
+      default: pgm.func("timezone('UTC', now())"),
+    },
+
+    updated_at: {
+      type: "timestamptz",
+      notNull: true,
+      default: pgm.func("timezone('UTC', now())"),
+    },
+  });
+};
+
+exports.down = false;

infra/webserver.js

@@ -0,0 +1,17 @@
+function getOrigin() {
+  if (["test", "development"].includes(process.env.NODE_ENV)) {
+    return "http://localhost:3000";
+  }
+
+  if (process.env.VERCEL_ENV === "preview") {
+    return `https://${process.env.VERCEL_URL}`;
+  }
+
+  return "https://clone-tabnews-lime-psi.vercel.app";
+}
+
+const webserver = {
+  origin: getOrigin(),
+};
+
+export default webserver;