Release/project day

api/handlers/authentication.go

@@ -283,7 +283,7 @@
 	}
 	if !valid {
 		logger.Error("Invalid pin")
-		h.DisputeProceedingsLogger.LogDisputeProceedings(models.Users, map[string]interface{}{"user": userVerify, "message": "Invalid pin"})
+		h.DisputeProceedingsLogger.LogDisputeProceedings(models.Users, map[string]interface{}{"user": jwtUser, "message": "Invalid pin"})
 		c.JSON(http.StatusBadRequest, models.Response{Error: "Invalid pin"})
 		return
 	}
@@ -456,7 +456,7 @@
 	}
 
 	//send an email to the user with a temporary link to reset the password
-	linkURL := fmt.Sprintf("%s/reset-password/%s", frontendBase, jwt)
+	linkURL := fmt.Sprintf("%s/reset/%s", frontendBase, jwt)
 	email := models.Email{
 		From:    companyEmail,
 		To:      user.Email,

api/handlers/dispute/dispute.go

@@ -650,6 +650,14 @@
 func (h Dispute) UpdateStatus(c *gin.Context) {
 	var disputeStatus models.DisputeStatusChange
 	logger := utilities.NewLogger().LogWithCaller()
+	claims, err := h.JWT.GetClaims(c)
+
+	if err != nil || claims.Role != "admin" {
+		logger.Error("Unauthorized access attempt")
+		c.JSON(http.StatusUnauthorized, models.Response{Error: "Unauthorized"})
+		return
+	}
+
 	if err := c.BindJSON(&disputeStatus); err != nil {
 		logger.WithError(err).Error("Invalid request body")
 		c.JSON(http.StatusBadRequest, models.Response{Error: "Invalid request body"})
@@ -814,7 +822,7 @@
 
 	// Get info from token
 	claims, err := h.JWT.GetClaims(c)
-	if err != nil {
+	if err != nil || claims.Role != "admin" {
 		logger.WithError(err).Error("Unauthorized access attempt", claims, err)
 		c.JSON(http.StatusUnauthorized, models.Response{Error: "Unauthorized"})
 		return

api/handlers/dispute/dispute_test.go

@@ -1161,6 +1161,7 @@ func (suite *DisputeErrorTestSuite) TestExpertObjectionsReviewInvalidRequestBody
 	req.Header.Add("Authorization", "Bearer mock")
 	req.Header.Add("Content-Type", "application/json")
 
+	suite.jwtMock.returnUser.Role = "admin"
 	w := httptest.NewRecorder()
 	suite.router.ServeHTTP(w, req)
 
@@ -1195,6 +1196,7 @@ func (suite *DisputeErrorTestSuite) TestExpertObjectionsReviewErrorReviewingObje
 	req.Header.Add("Authorization", "Bearer mock")
 	req.Header.Add("Content-Type", "application/json")
 
+	suite.jwtMock.returnUser.Role = "admin"
 	suite.disputeMock.throwErrors = true
 
 	w := httptest.NewRecorder()
@@ -1214,6 +1216,8 @@ func (suite *DisputeErrorTestSuite) TestExpertObjectionsReviewSuccess() {
 	req.Header.Add("Authorization", "Bearer mock")
 	req.Header.Add("Content-Type", "application/json")
 
+	suite.jwtMock.returnUser.Role = "admin"
+
 	w := httptest.NewRecorder()
 	suite.router.ServeHTTP(w, req)
 
@@ -1233,7 +1237,7 @@ func (suite *DisputeErrorTestSuite) TestExpertObjectionErrorDuringObjection() {
 	req.Header.Add("Content-Type", "application/json")
 
 	suite.disputeMock.throwErrors = true
-
+	suite.jwtMock.returnUser.Role = "admin"
 	w := httptest.NewRecorder()
 	suite.router.ServeHTTP(w, req)
 
@@ -1291,7 +1295,7 @@ func (suite *DisputeErrorTestSuite) TestExpertObjectionSuccess() {
 	req, _ := http.NewRequest("POST", "/1/objections", bytes.NewBuffer([]byte(reqBody)))
 	req.Header.Add("Authorization", "Bearer mock")
 	req.Header.Add("Content-Type", "application/json")
-
+	suite.jwtMock.returnUser.Role = "admin"
 	//inject the mock
 	suite.disputeMock.throwErrors = false
 	suite.disputeMock.Get_Experts = []models.AdminDisputeExperts{
@@ -1328,7 +1332,7 @@ func (suite *DisputeErrorTestSuite) TestExpertObjectionUnauthorized() {
 func (suite *DisputeErrorTestSuite) TestExpertObjectionInvalidDisputeID() {
 	req, _ := http.NewRequest("POST", "/invalid/objections", nil)
 	req.Header.Add("Authorization", "Bearer mock")
-
+	suite.jwtMock.returnUser.Role = "admin"
 	w := httptest.NewRecorder()
 	suite.router.ServeHTTP(w, req)
 
@@ -1343,7 +1347,7 @@ func (suite *DisputeErrorTestSuite) TestExpertObjectionInvalidRequestBody() {
 	req, _ := http.NewRequest("POST", "/1/objections", bytes.NewBuffer([]byte("invalid body")))
 	req.Header.Add("Authorization", "Bearer mock")
 	req.Header.Add("Content-Type", "application/json")
-
+	suite.jwtMock.returnUser.Role = "admin"
 	w := httptest.NewRecorder()
 	suite.router.ServeHTTP(w, req)
 
@@ -1358,9 +1362,9 @@ func (suite *DisputeErrorTestSuite) TestExpertObjectionInvalidRequestBody() {
 func (suite *DisputeErrorTestSuite) TestUpdateStatusInvalidRequestBody() {
 	req, _ := http.NewRequest("PUT", "/dispute/status", bytes.NewBuffer([]byte("invalid body")))
 	req.Header.Add("Content-Type", "application/json")
+	suite.jwtMock.returnUser.Role = "admin"
 	w := httptest.NewRecorder()
 	suite.router.ServeHTTP(w, req)
-
 	suite.Equal(http.StatusBadRequest, w.Code)
 	var result models.Response
 	suite.NoError(json.Unmarshal(w.Body.Bytes(), &result))
@@ -1383,6 +1387,7 @@ func (suite *DisputeErrorTestSuite) TestUpdateStatusUnauthorized() {
 func (suite *DisputeErrorTestSuite) TestUpdateStatusInternalError() {
 	suite.jwtMock.throwErrors = false
 	suite.disputeMock.throwErrors = true
+	suite.jwtMock.returnUser.Role = "admin"
 	req, _ := http.NewRequest("PUT", "/1/status", bytes.NewBuffer([]byte(`{"status": "Resolved"}`)))
 	req.Header.Add("Content-Type", "application/json")
 	req.Header.Add("Authorization", "Bearer mock")
@@ -1398,6 +1403,7 @@ func (suite *DisputeErrorTestSuite) TestUpdateStatusInternalError() {
 func (suite *DisputeErrorTestSuite) TestUpdateStatusSuccess() {
 	suite.jwtMock.throwErrors = false
 	suite.disputeMock.throwErrors = false
+	suite.jwtMock.returnUser.Role = "admin"
 	req, _ := http.NewRequest("PUT", "/1/status", bytes.NewBuffer([]byte(`{"status": "Resolved"}`)))
 	req.Header.Add("Content-Type", "application/json")
 	req.Header.Add("Authorization", "Bearer mock")

api/handlers/workflow/workflow.go

@@ -138,6 +138,10 @@
 	logger := utilities.NewLogger().LogWithCaller()
 	var workflow models.CreateWorkflow
 
+	if (!w.IsAuthorized(c, "admin", logger)) {
+		return
+	}
+
 	// Bind incoming JSON to the struct
 	err := c.BindJSON(&workflow)
 	if err != nil {
@@ -253,6 +257,11 @@
 
 func (w Workflow) UpdateWorkflow(c *gin.Context) {
 	logger := utilities.NewLogger().LogWithCaller()
+
+	if (!w.IsAuthorized(c, "admin", logger)) {
+		return
+	}
+
 	id := c.Param("id")
 	idInt, err := strconv.Atoi(id)
 	if err != nil {
@@ -353,6 +362,12 @@
 
 func (w Workflow) DeleteWorkflow(c *gin.Context) {
 	logger := utilities.NewLogger().LogWithCaller()
+
+	if (!w.IsAuthorized(c, "admin", logger)) {
+		return
+	}
+
+
 	id := c.Param("id")
 	idInt, err := strconv.Atoi(id)
 	if err != nil {
@@ -602,6 +617,14 @@
 	c.JSON(http.StatusOK, models.Response{Data: response})
 }
 
-
+func (h Workflow) IsAuthorized(c *gin.Context, role string, logger *utilities.Logger) bool {
+	claims, err := h.Jwt.GetClaims(c)
+	if err != nil || claims.Role != role {
+		logger.WithError(err).Error("Unauthorized")
+		c.JSON(401, models.Response{Error: "Unauthorized"})
+		return false
+	}
+	return true
+}