adds user roles, default admin account, invite specific roles, record inviting user

Author: tdjsnelling

api/src/controllers/user.js

@@ -16,6 +16,8 @@ export const register = async (req, res) => {
   }
 
   if (req.body.username && req.body.email && req.body.password) {
+    let invite
+
     if (process.env.SQ_ALLOW_REGISTER === 'invite') {
       if (!req.body.invite) {
         res
@@ -25,12 +27,14 @@ export const register = async (req, res) => {
           )
         return
       }
+    }
 
+    if (req.body.invite) {
       try {
         const decoded = jwt.verify(req.body.invite, process.env.SQ_JWT_SECRET)
         const { id } = decoded
 
-        const invite = await Invite.findOne({ _id: id }).lean()
+        invite = await Invite.findOne({ _id: id }).lean()
         const { claimed, validUntil, invitingUser } = invite
 
         if (claimed) {
@@ -65,13 +69,16 @@ export const register = async (req, res) => {
 
       if (!user) {
         const hash = await bcrypt.hash(req.body.password, 10)
+        const role = invite?.role || 'user'
 
         const newUser = new User({
           username: req.body.username,
           email: req.body.email,
           password: hash,
           torrents: {},
           created,
+          role,
+          invitedBy: invite?.invitingUser,
         })
 
         newUser.uid = crypto
@@ -83,7 +90,8 @@ export const register = async (req, res) => {
         newUser.token = jwt.sign(
           {
             id: newUser._id,
-            created: created,
+            created,
+            role,
           },
           process.env.SQ_JWT_SECRET
         )
@@ -144,11 +152,14 @@ export const generateInvite = async (req, res) => {
   const created = Date.now()
   const validUntil = created + 48 * 60 * 60 * 1000
 
+  const { role } = req.query
+
   const invite = new Invite({
     invitingUser: req.userId,
     created,
     validUntil,
     claimed: false,
+    role: role || 'user',
   })
 
   invite.token = jwt.sign(

api/src/index.js

@@ -25,6 +25,7 @@ import {
   listLatest,
   searchTorrents,
 } from './controllers/torrent'
+import createAdminUser from './setup/createAdminUser'
 
 const connectToDb = () => {
   console.log('[sq] initiating db connection...')
@@ -43,6 +44,7 @@ connectToDb()
 
 mongoose.connection.once('open', () => {
   console.log('[sq] connected to mongodb successfully')
+  createAdminUser()
 })
 
 const app = express()

api/src/schema/invite.js

@@ -6,6 +6,7 @@ const Invite = new mongoose.Schema({
   validUntil: Number,
   claimed: Boolean,
   token: String,
+  role: String,
 })
 
 export default mongoose.model('invite', Invite)

api/src/schema/user.js

@@ -9,6 +9,8 @@ const User = new mongoose.Schema({
   token: String,
   created: Number,
   banned: Boolean,
+  role: String,
+  invitedBy: mongoose.Schema.ObjectId,
 })
 
 export default mongoose.model('user', User)

api/src/setup/createAdminUser.js

@@ -0,0 +1,35 @@
+import bcrypt from 'bcrypt'
+import crypto from 'crypto'
+import jwt from 'jsonwebtoken'
+import User from '../schema/user'
+
+const createAdminUser = async () => {
+  const existingAdmin = await User.findOne({ username: 'admin' }).lean()
+  if (!existingAdmin) {
+    const created = Date.now()
+    const hash = await bcrypt.hash('admin', 10)
+    const adminUser = new User({
+      username: 'admin',
+      email: 'admin@sqtracker',
+      role: 'admin',
+      password: hash,
+      created,
+    })
+    adminUser.uid = crypto
+      .createHash('sha256')
+      .update(adminUser._id.toString())
+      .digest('hex')
+      .slice(0, 10)
+    adminUser.token = jwt.sign(
+      {
+        id: adminUser._id,
+        created,
+        role: 'admin',
+      },
+      process.env.SQ_JWT_SECRET
+    )
+    await adminUser.save()
+  }
+}
+
+export default createAdminUser

client/components/Infobox.js

@@ -0,0 +1,17 @@
+import React from 'react'
+import Box from './Box'
+
+const Infobox = ({ children, ...rest }) => (
+  <Box
+    bg="sidebar"
+    border="1px solid"
+    borderColor="border"
+    borderRadius={1}
+    p={4}
+    {...rest}
+  >
+    {children}
+  </Box>
+)
+
+export default Infobox

client/pages/account.js

@@ -2,30 +2,41 @@ import React, { useState } from 'react'
 import getConfig from 'next/config'
 import moment from 'moment'
 import copy from 'copy-to-clipboard'
+import jwt from 'jsonwebtoken'
 import { Copy } from '@styled-icons/boxicons-regular/Copy'
 import withAuth from '../utils/withAuth'
 import getReqCookies from '../utils/getReqCookies'
 import SEO from '../components/SEO'
 import Box from '../components/Box'
 import Text from '../components/Text'
+import Infobox from '../components/Infobox'
 import Input from '../components/Input'
+import Select from '../components/Select'
 import Button from '../components/Button'
 import List from '../components/List'
 
-const Account = ({ token, invites }) => {
+const Account = ({ token, invites, userRole }) => {
   const [invitesList, setInvitesList] = useState(invites)
 
   const {
     publicRuntimeConfig: { SQ_API_URL },
   } = getConfig()
 
-  const handleGenerateInvite = async () => {
+  const handleGenerateInvite = async (e) => {
+    e.preventDefault()
+    const form = new FormData(e.target)
+
     try {
-      const inviteRes = await fetch(`${SQ_API_URL}/account/generate-invite`, {
-        headers: {
-          Authorization: `Bearer ${token}`,
-        },
-      })
+      const inviteRes = await fetch(
+        `${SQ_API_URL}/account/generate-invite?role=${
+          form.get('role') || 'user'
+        }`,
+        {
+          headers: {
+            Authorization: `Bearer ${token}`,
+          },
+        }
+      )
       const invite = await inviteRes.json()
       setInvitesList((cur) => {
         const currentInvitesList = [...cur]
@@ -68,51 +79,75 @@ const Account = ({ token, invites }) => {
       <Text as="h1" mb={5}>
         My account
       </Text>
+      {userRole === 'admin' && (
+        <Infobox mb={5}>
+          <Text>This is an admin account.</Text>
+        </Infobox>
+      )}
       <Box
         display="flex"
         alignItems="center"
         justifyContent="space-between"
         mb={4}
       >
         <Text as="h2">Invites</Text>
-        <Button onClick={handleGenerateInvite}>Generate invite</Button>
+        <form onSubmit={handleGenerateInvite}>
+          <Box display="flex" alignItems="center">
+            {userRole === 'admin' && (
+              <Select name="role" required mr={3}>
+                <option value="user">Role: user</option>
+                <option value="admin">Role: admin</option>
+              </Select>
+            )}
+            <Button>Generate invite</Button>
+          </Box>
+        </form>
       </Box>
       <List
         data={invitesList}
         columns={[
           {
+            header: 'Token',
             accessor: 'token',
             cell: ({ value }) => (
               <Text fontFamily="monospace">
-                {value.slice(0, 10)}...{value.slice(value.length - 10)}
+                ...{value.slice(value.length - 16)}
               </Text>
             ),
             gridWidth: '1fr',
           },
           {
+            header: 'Claimed',
             accessor: 'claimed',
-            cell: ({ value }) => (
-              <Text>{value ? 'Claimed' : 'Not claimed'}</Text>
-            ),
+            cell: ({ value }) => <Text>{value ? 'Yes' : 'No'}</Text>,
             gridWidth: '0.5fr',
           },
           {
+            header: 'Valid until',
             accessor: 'validUntil',
             cell: ({ value }) => (
-              <Text>
-                Valid until {moment(value).format('HH:mm Do MMM YYYY')}
-              </Text>
+              <Text>{moment(value).format('HH:mm Do MMM YYYY')}</Text>
             ),
             gridWidth: '1.2fr',
           },
           {
+            header: 'Created',
             accessor: 'created',
             cell: ({ value }) => (
-              <Text>Created {moment(value).format('Do MMM YYYY')}</Text>
+              <Text>{moment(value).format('HH:mm Do MMM YYYY')}</Text>
             ),
             gridWidth: '1fr',
           },
           {
+            header: 'Role',
+            accessor: 'role',
+            cell: ({ value }) => (
+              <Text css={{ textTransform: 'capitalize' }}>{value}</Text>
+            ),
+            gridWidth: '0.6fr',
+          },
+          {
+            header: 'Copy',
             cell: ({ row }) => (
               <Button
                 variant="secondary"
@@ -128,7 +163,8 @@ const Account = ({ token, invites }) => {
                 <Copy size={24} />
               </Button>
             ),
-            gridWidth: '32px',
+            rightAlign: true,
+            gridWidth: '42px',
           },
         ]}
         mb={5}
@@ -164,8 +200,11 @@ export const getServerSideProps = async ({ req }) => {
 
   const {
     publicRuntimeConfig: { SQ_API_URL },
+    serverRuntimeConfig: { SQ_JWT_SECRET },
   } = getConfig()
 
+  const { role } = jwt.verify(token, SQ_JWT_SECRET)
+
   try {
     const invitesRes = await fetch(`${SQ_API_URL}/account/invites`, {
       headers: {
@@ -174,7 +213,7 @@ export const getServerSideProps = async ({ req }) => {
       },
     })
     const invites = await invitesRes.json()
-    return { props: { invites } }
+    return { props: { invites, userRole: role } }
   } catch (e) {
     return { props: {} }
   }

client/pages/register.js

@@ -90,7 +90,7 @@ export const getServerSideProps = async ({ query: { token } }) => {
   const {
     serverRuntimeConfig: { SQ_JWT_SECRET, SQ_ALLOW_REGISTER },
   } = getConfig()
-  if (SQ_ALLOW_REGISTER === 'open') return { props: {} }
+
   if (!token && SQ_ALLOW_REGISTER === 'invite')
     return { props: { tokenError: 'Invite token not provided' } }
   try {