Merge pull request #7 from hackclub/staging

Beta channel check

Author: ArcaEge

.env.example

@@ -14,6 +14,7 @@ APP_SECRET_KEY=changeme
 
 SLACK_BOT_TOKEN=changeme
 SLACK_TEAM=T0266FRGM
+# BETA_CHANNEL_ID=
 
 SUPER_ADMIN_SLACK_ID=changeme
 

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "construct",
 	"private": true,
-	"version": "0.0.1",
+	"version": "0.1.1",
 	"type": "module",
 	"scripts": {
 		"dev": "vite dev",

src/routes/+page.server.ts

@@ -3,6 +3,6 @@ import { env } from '$env/dynamic/private';
 export function load({ locals }) {
 	return {
 		loggedIn: locals.session !== null,
-		idvDomain: env.IDV_DOMAIN
+		idvDomain: env.IDV_DOMAIN,
 	};
 }

src/routes/Footer.svelte

@@ -2,7 +2,7 @@
 </script>
 
 <footer
-	class="flex w-full flex-col items-center justify-center px-10 pt-5 pb-3 md:mt-8 lg:mt-8 lg:flex-row"
+	class="flex w-full flex-col items-center justify-center px-10 pt-5 pb-3 md:mt-8 lg:mt-8"
 >
 	<div class="">
 		<p class="text-center">

src/routes/auth/callback/+server.ts

@@ -106,6 +106,32 @@ export async function GET(event) {
 	const profilePic = slackProfile['profile']['image_1024'];
 	const username = slackProfile['profile']['display_name'];
 
+	if (env.BETA_CHANNEL_ID && env.BETA_CHANNEL_ID.length > 0) {
+		const channelMembersURL = new URL('https://slack.com/api/conversations.members');
+		channelMembersURL.searchParams.set('channel', env.BETA_CHANNEL_ID);
+
+		const channelMembersBody = new URLSearchParams();
+		channelMembersBody.append('token', env.SLACK_BOT_TOKEN ?? '');
+
+		const channelMembersRes = await fetch(channelMembersURL, {
+			method: 'POST',
+			body: channelMembersBody
+		});
+
+		const channelMembersResJSON = await channelMembersRes.json();
+
+		if (!channelMembersResJSON.ok) {
+			const redirectURL = new URL(`${url.protocol}//${url.host}/auth/failed`);
+			return redirect(302, redirectURL);
+		}
+
+		if (!channelMembersResJSON['members'].includes(slack_id)) {
+			// redirect to funny url
+			const redirectURL = new URL(`https://www.youtube.com/watch?v=xvFZjo5PgG0`);
+			return redirect(302, redirectURL);
+		}
+	}
+
 	// Check Hackatime trust
 	const hackatimeTrust = (
 		await (
@@ -130,6 +156,11 @@ export async function GET(event) {
 	// Create user if doesn't exist
 	let [databaseUser] = await db.select().from(user).where(eq(user.idvId, id)).limit(1);
 
+	if (databaseUser.trust === 'red') {
+		// Prevent login
+		return redirect(302, 'https://fraud.land');
+	}
+
 	if (databaseUser) {
 		// Update user (update name and profile picture and lastLoginAt on login)
 		await db