prevent non staff access

Author: mluukkai

src/client/util/apiClient.ts

@@ -1,3 +1,4 @@
+/* eslint-disable no-console */
 import axios from 'axios'
 
 import { PUBLIC_URL } from '@config'
@@ -6,4 +7,18 @@ const baseURL = `${PUBLIC_URL}/api`
 
 const apiClient = axios.create({ baseURL })
 
+// Intercept 401 and 500 responses and let them bubble up to error boundary
+apiClient.interceptors.response.use(
+  response => response,
+  error => {
+    if (error.response?.status === 401) {
+      console.warn('Unauthorized request:', error.config?.url)
+    } else if (error.response?.status === 500) {
+      console.error('Server error:', error.config?.url)
+    }
+    // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors
+    return Promise.reject(error)
+  }
+)
+
 export default apiClient

src/client/util/queryClient.ts

@@ -4,6 +4,10 @@ const queryClient = new QueryClient({
   defaultOptions: {
     queries: {
       refetchOnWindowFocus: false,
+      // Throw errors to error boundary for 401 and 500 errors
+      useErrorBoundary: (error: any) => {
+        return error?.response?.status === 401 || error?.response?.status === 500
+      },
     },
   },
 })

src/server/middleware/mockUser.ts

@@ -0,0 +1,13 @@
+import { getMockUser } from '../mocs/user'
+
+const mockUserMiddleware = (req, _, next) => {
+  if (req.path.includes('/login')) {
+    return next()
+  }
+
+  req.user = getMockUser()
+
+  return next()
+}
+
+export default mockUserMiddleware

src/server/middleware/user.ts

@@ -1,13 +1,12 @@
-import { getMockUser } from '../mocs/user'
+import { NextFunction, Response } from 'express'
+import UnauthorizedError from '../errors/UnauthorizedError'
 
-const userMiddleware = (req, _, next) => {
-  if (req.path.includes('/login')) {
-    return next()
+const userAccessHandler = (req, res: Response, next: NextFunction) => {
+  if (!req?.user?.iamGroups?.includes('hy-employees')) {
+    throw new UnauthorizedError('Unauthorized')
   }
 
-  req.user = getMockUser()
-
   return next()
 }
 
-export default userMiddleware
+export default userAccessHandler

src/server/mocs/user.ts

@@ -9,7 +9,7 @@ const mockUsers = {
     email: 'grp-toska@helsinki.fi',
     language: 'fi',
     isAdmin: true,
-    iamGroups: ['grp-toska', 'hy-mltdk-employees'],
+    iamGroups: ['grp-toska', 'hy-employees'],
   },
   normal: {
     id: 'normaltestuser',
@@ -19,7 +19,17 @@ const mockUsers = {
     email: 'matti.luukkainen@helsinki.fi',
     language: 'fi',
     isAdmin: false,
-    iamGroups: ['hy-mltdk-employees'],
+    iamGroups: ['hy-employees'],
+  },
+  student: {
+    id: 'student',
+    username: 'hy-hlo-221212',
+    firstName: 'Matti',
+    lastName: 'Meikäläinen',
+    email: 'matti.meikalainen@helsinki.fi',
+    language: 'fi',
+    isAdmin: false,
+    iamGroups: [],
   },
 }
 

src/server/routes/index.ts

@@ -4,7 +4,8 @@ import * as Sentry from '@sentry/node'
 
 import { inDevelopment, inE2EMode, inAcualStaging } from '@config'
 import initializeSentry from '../util/sentry'
-import userMiddleware from '../middleware/user'
+import mockUserMiddleware from '../middleware/mockUser'
+import userAccessMiddleware from '../middleware/user'
 import sentryUserMiddleware from '../middleware/sentry'
 import errorHandler from '../middleware/error'
 import accessLogger from '../middleware/access'
@@ -32,10 +33,9 @@ router.use(cors())
 router.use(express.json())
 
 if (inDevelopment || inE2EMode || inAcualStaging) {
-  router.use(userMiddleware)
+  router.use(mockUserMiddleware)
 }
 
-// Set Sentry user context after user middleware
 router.use(sentryUserMiddleware)
 
 router.use(accessLogger)
@@ -58,13 +58,16 @@ router.post('/seed', adminHandler, async (_, res) => {
   res.send('Database seeded successfully')
 })
 
+router.use('/login', loginRouter)
+
+router.use(userAccessMiddleware)
+
 router.use('/faculties', facultyRouter)
 router.use('/surveys', surveyRouter)
 router.use('/questions', questionRouter)
 router.use('/results', resultRouter)
 router.use('/entries', entryRouter)
 router.use('/users', userRouter)
-router.use('/login', loginRouter)
 router.use('/countries', countryRouter)
 router.use('/organizations', organizationRouter)
 router.use('/warnings', warningsRouter)