From a117515f00b51df4b0e5cd23f1a41a8fdc5a7777 Mon Sep 17 00:00:00 2001
From: haveyaseen <haveyaread@gmail.com>
Date: Mon, 12 Jul 2021 20:51:33 +0200
Subject: [PATCH] perform user in group authorization properly (need to await
 and return true as well!)

---
 src/comp/util/WebrtcProvider.svelte | 20 ++++++++++-------
 src/routes/_layout.svelte           |  8 +++----
 src/routes/chat.svelte              |  6 +++--
 src/server/auth.ts                  |  2 ++
 src/server/socket/call.ts           | 35 ++++++++++++++++++-----------
 src/server/socket/index.ts          |  8 +++++--
 6 files changed, 50 insertions(+), 29 deletions(-)

diff --git a/src/comp/util/WebrtcProvider.svelte b/src/comp/util/WebrtcProvider.svelte
index 4602a140..f3cb4761 100644
--- a/src/comp/util/WebrtcProvider.svelte
+++ b/src/comp/util/WebrtcProvider.svelte
@@ -96,7 +96,7 @@
             try {
                 // Subscribe to a remote user.
                 await client.subscribe(user, mediaType)
-            } catch (_e) {
+            } catch {
                 return
             }
 
@@ -118,7 +118,7 @@
             }
             try {
                 await client.unsubscribe(user, mediaType)
-            } catch (_e) {}
+            } catch {}
         })
 
         const rtcToken = await getAgoraToken(roomId)
@@ -154,7 +154,7 @@
             $joining = false
             try {
                 await client!.leave()
-            } catch (_e) {
+            } catch {
                 return false
             }
             return false
@@ -185,12 +185,16 @@
             }
         }
         if ($outgoing) {
-            await client.unpublish([$outgoing])
-            $outgoing.stop()
-            $outgoing.close()
-            $outgoing = null
+            try {
+                await client.unpublish([$outgoing])
+            } catch {}
         }
-        await client.leave()
+        $outgoing?.stop()
+        $outgoing?.close()
+        $outgoing = null
+        try {
+            await client.leave()
+        } catch {}
         $joinedRoom = null
         return unsubscribedFromAllRemoteUsers
     }
diff --git a/src/routes/_layout.svelte b/src/routes/_layout.svelte
index 2162249d..23bf04b7 100644
--- a/src/routes/_layout.svelte
+++ b/src/routes/_layout.svelte
@@ -69,8 +69,8 @@
 </script>
 
 <LocaleProvider {segment}>
-    <WebrtcProvider>
-        <ChatProvider>
+    <ChatProvider>
+        <WebrtcProvider>
             <div id="app" class:noscroll class:with-main-nav={showMainNav}>
                 {#if showMainNav}
                     <MainNav {segment} />
@@ -88,8 +88,8 @@
                     {/key}
                 </main>
             </div>
-        </ChatProvider>
-    </WebrtcProvider>
+        </WebrtcProvider>
+    </ChatProvider>
 </LocaleProvider>
 
 <style>
diff --git a/src/routes/chat.svelte b/src/routes/chat.svelte
index 185a65cb..6117e978 100644
--- a/src/routes/chat.svelte
+++ b/src/routes/chat.svelte
@@ -202,7 +202,7 @@
 
         if (fetchGroupMetadataInterval === null) {
             const FETCH_GROUP_METADATA_INTERVAL_SECS = 30
-            fetchGroupMetadataInterval = setInterval(
+            fetchGroupMetadataInterval = window.setInterval(
                 () => fetchGroupMetadata({ groupUuid: $groupUuid }),
                 FETCH_GROUP_METADATA_INTERVAL_SECS * 1000
             )
@@ -360,7 +360,9 @@
 
     function handleBeforeunload(): void {
         if ($joinedCallRoom) {
-            chat.emit("userLeaveCall", { groupUuid: $joinedCallRoom })
+            chat.emit("userLeaveCall", {
+                groupUuid: $joinedCallRoom,
+            })
         }
         chat.leaveRoom()
         chat.disconnect()
diff --git a/src/server/auth.ts b/src/server/auth.ts
index 3cfbae1b..c4012288 100644
--- a/src/server/auth.ts
+++ b/src/server/auth.ts
@@ -29,4 +29,6 @@ export async function authenticateUserInGroup(
             .debug("Group doesn't exist or user is not part of group")
         return false
     }
+
+    return true
 }
diff --git a/src/server/socket/call.ts b/src/server/socket/call.ts
index d4dcc968..930be459 100644
--- a/src/server/socket/call.ts
+++ b/src/server/socket/call.ts
@@ -25,7 +25,7 @@ export function handleUserConnected(io: SocketIO, socket: EverglotChatSocket) {
                 .error("Failed to get group call user metadata")
             return
         }
-        if (!authenticateUserInGroup(userId, groupUuid)) {
+        if (!(await authenticateUserInGroup(userId, groupUuid))) {
             chlog
                 .child({ userId, groupUuid })
                 .debug("User is not in group but tried to join call")
@@ -49,13 +49,15 @@ export function handleUserConnected(io: SocketIO, socket: EverglotChatSocket) {
                 .error("Failed to get group call user metadata")
             return
         }
-        if (!authenticateUserInGroup(userId, groupUuid)) {
-            chlog
-                .child({ userId, groupUuid, userMeta })
-                .debug("User is not in group but tried to leave call")
-            return
+        if (groupUuid !== null) {
+            if (!(await authenticateUserInGroup(userId, groupUuid))) {
+                chlog
+                    .child({ userId, groupUuid, userMeta })
+                    .debug("User is not in group but tried to leave call")
+                return
+            }
         }
-        const userLeaving = userLeave(userMeta.uuid, groupUuid)
+        const userLeaving = userLeave(userMeta.uuid, groupUuid as string)
         if (!userLeaving) {
             chlog
                 .child({ userId, groupUuid, userMeta })
@@ -88,7 +90,7 @@ export function handleUserConnected(io: SocketIO, socket: EverglotChatSocket) {
                 return
             }
             const { uuid: userUuid } = userMeta
-            if (!authenticateUserInGroup(userId, groupUuid)) {
+            if (!(await authenticateUserInGroup(userId, groupUuid))) {
                 chlog
                     .child({ userId, userUuid, groupUuid })
                     .debug("User is not in group but tried to join call")
@@ -159,7 +161,7 @@ function userLeave(userUuid: string, groupUuid: string) {
 
     if (!existingUser) {
         chlog
-            .child({ userUuid, groupUuid })
+            .child({ userUuid, groupUuid, users })
             .debug("User is not in group call, preventing leave")
         return false
     }
@@ -167,11 +169,18 @@ function userLeave(userUuid: string, groupUuid: string) {
         chlog
             .child({ userUuid, groupUuid, existingUser })
             .debug(
-                "User is leaving group call but for a different group than the one in whose call they are. " +
-                    "We're letting them leave that call anyways."
+                groupUuid === null
+                    ? "User is leaving group call but they didn't say which group that call was in." +
+                          "We're letting them leave that call anyways."
+                    : "User is leaving group call but for a different group than the one in whose call they are. " +
+                          "We're letting them leave that call anyways."
             )
     }
-    return users.splice(index, 1)[0]
+    const removedUser = users.splice(index, 1)[0]
+    chlog
+        .child({ userUuid, groupUuid, removedUser, users })
+        .debug("Successfully removed user from voice call")
+    return removedUser
 }
 
 function userUpdateMeta(
@@ -187,7 +196,7 @@ function userUpdateMeta(
     if (index === -1) {
         chlog
             .child({ userUuid, groupUuid })
-            .debug("User is not in group call, preventing leave")
+            .debug("User is not in group call, preventing call meta update")
         return false
     } else {
         users[index] = {
diff --git a/src/server/socket/index.ts b/src/server/socket/index.ts
index 36b25c23..3e82a7bc 100644
--- a/src/server/socket/index.ts
+++ b/src/server/socket/index.ts
@@ -44,10 +44,14 @@ export function start(server: Server, pool: Pool) {
             const userId = session.user_id
             const userMeta = await getChatUserByUserId(userId)
             if (!userMeta) {
+                chlog.child({ userId }).warn("Failed to retrieve user meta")
                 return
             }
 
-            if (!authenticateUserInGroup(userId, groupUuid)) {
+            if (!(await authenticateUserInGroup(userId, groupUuid))) {
+                chlog
+                    .child({ userId, groupUuid })
+                    .debug("User is not authorized to join this group")
                 return
             }
 
@@ -111,7 +115,7 @@ export function start(server: Server, pool: Pool) {
                 }
                 const { uuid: userUuid } = userMeta
 
-                if (!authenticateUserInGroup(userId, groupUuid)) {
+                if (!(await authenticateUserInGroup(userId, groupUuid))) {
                     return
                 }