diff --git a/backend/controller/organisasiEksternalController.js b/backend/controller/organisasiEksternalController.js index 8e1cef0e697212b1d69033d98a40b9fa1e83296c..d28cae3cc67b3d42e3283e62e520857098b6ac9f 100644 --- a/backend/controller/organisasiEksternalController.js +++ b/backend/controller/organisasiEksternalController.js @@ -49,26 +49,34 @@ exports.editOrganisasiEksternal = (req, res) => { id: req.body.id } }).then(organisasi => { - organisasi.update( - { - name: req.body.name - }, - { - fields: ['name'] - } - ).then(() => { - res.send({ - "status": "success", - "message": "Organisasi eksternal has successfully edited", - "data": null - }); - }).catch(err => { - res.status(500).send({ + if (organisasi === null) { + res.status(500).json({ "status": "error", - "message": "Can not edit organisasi eksternal", - "data": null + "message": "Organisasi is not valid", + "data": null }); - }); + } else { + organisasi.update( + { + name: req.body.name + }, + { + fields: ['name'] + } + ).then(() => { + res.send({ + "status": "success", + "message": "Organisasi eksternal has successfully edited", + "data": null + }); + }).catch(err => { + res.status(500).send({ + "status": "error", + "message": "Can not edit organisasi eksternal", + "data": null + }); + }); + } }).catch(err => { res.status(500).send({ "status": "error", diff --git a/backend/controller/organisasiInternalController.js b/backend/controller/organisasiInternalController.js index 499f0a33b014a7c4b27ad37601ad210ebe098585..e9b4eaa3ecd756403e9b99d81513ee8407decb7c 100644 --- a/backend/controller/organisasiInternalController.js +++ b/backend/controller/organisasiInternalController.js @@ -49,26 +49,34 @@ exports.editOrganisasiInternal = (req, res) => { id: req.body.id } }).then(organisasi => { - organisasi.update( - { - name: req.body.name - }, - { - fields: ['name'] - } - ).then(() => { - res.send({ - "status": "success", - "message": "Organisasi internal has successfully edited", - "data": null - }); - }).catch(err => { - res.status(500).send({ + if (organisasi === null) { + res.status(500).json({ "status": "error", - "message": "Can not edit organisasi internal", - "data": null + "message": "Organisasi is not valid", + "data": null }); - }); + } else { + organisasi.update( + { + name: req.body.name + }, + { + fields: ['name'] + } + ).then(() => { + res.send({ + "status": "success", + "message": "Organisasi internal has successfully edited", + "data": null + }); + }).catch(err => { + res.status(500).send({ + "status": "error", + "message": "Can not edit organisasi internal", + "data": null + }); + }); + } }).catch(err => { res.status(500).send({ "status": "error", diff --git a/backend/controller/permissionController.js b/backend/controller/permissionController.js new file mode 100644 index 0000000000000000000000000000000000000000..462360bb06722080ddbe8d70d28e03907592c9d0 --- /dev/null +++ b/backend/controller/permissionController.js @@ -0,0 +1,104 @@ +const models = require('../models'); +const Role = models.role; +const Permission = models.permission; +const Role_Permission = models.role_permission; + +exports.fetchAllPermission = (req, res) => { + Permission.findAll({ + attributes: ['id', 'name'] + }).then(permissions => { + res.status(200).json({ + "status": "success", + "message": "All permission data", + "data": { + "permissions": permissions + } + }); + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all permissions data", + "data": null + }) + }) +} + +exports.fetchPermissionList = (req, res) => { + Role.findOne({ + attributes: ['id'], + where: { + id: req.params.id + }, + include: [{ + model: Permission, + attributes: ['id', 'name'], + through: { + attributes: [] + } + }] + }).then(permissions => { + res.status(200).json({ + "status": "success", + "message": "Role's permission data", + "data": { + "permissions": permissions + } + }); + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all role data", + "data": null + }); + }); +} + +exports.editPermission = async (req, res) => { + var toBeInsert = []; + var toBeDelete = []; + var successAddAll = true; + var successDelAll = true; + var permissions = req.body.permissionEdit; + + await asyncForEach(permissions, async (data) => { + if (data.command === "INSERT") { + await Role_Permission.create({ + roleId: req.body.roleId, + permissionId: data.permissionId + }).catch(err => { + successAddAll = false; + }) + } else if (data.command === "DELETE"){ + await Role_Permission.destroy({ + where: { + roleId: req.body.roleId, + permissionId: data.permissionId + } + }).catch(err => { + successDelAll = false; + }) + } + console.log(successAddAll); + }); + + if (successAddAll && successDelAll) { + res.status(200).send({ + "status": "success", + "message": "Permissions has edited successfully", + "data": null + }); + } else { + res.status(500).send({ + "status": "error", + "message": "Some permissions might be not edited", + "data": null + }); + } +} + +async function asyncForEach(array, callback) { + for (let index = 0; index < array.length; index++) { + await callback(array[index], index, array); + } +} + diff --git a/backend/controller/roleController.js b/backend/controller/roleController.js index c78a0b943dc14b2046b22967962f99554e889f11..9ba2ff456d8ea85fa48eca1d2ce65898278f4e51 100644 --- a/backend/controller/roleController.js +++ b/backend/controller/roleController.js @@ -45,26 +45,34 @@ exports.editRole = (req, res) => { id: req.body.id } }).then(role => { - role.update( - { - name: req.body.name, - }, - { - fields: ['name'] - } - ).then(() => { - res.send({ - "status": "success", - "message": "Role has successfully edited", - "data": null - }); - }).catch(err => { - res.status(500).send({ + if (role === null) { + res.status(500).json({ "status": "error", - "message": "Can not edit role", - "data": null + "message": "Role is not valid", + "data": null }); - }); + } else { + role.update( + { + name: req.body.name, + }, + { + fields: ['name'] + } + ).then(() => { + res.send({ + "status": "success", + "message": "Role has successfully edited", + "data": null + }); + }).catch(err => { + res.status(500).send({ + "status": "error", + "message": "Can not edit role", + "data": null + }); + }); + } }).catch(err => { res.status(500).send({ "status": "error", diff --git a/backend/controller/userController.js b/backend/controller/userController.js index c3490c95f051a255dd6de81e7d78d60b09a50cc7..d7d3fa187faf30c00a72b0085ce4d1a25655423f 100644 --- a/backend/controller/userController.js +++ b/backend/controller/userController.js @@ -68,49 +68,65 @@ exports.editUser = (req, res) => { id: req.body.id } }).then(user => { - Role.findOne({ - where: { - name: req.body.role - } - }).then(role => { - user.setRole(role).then(() => { - user.update( - { - name: req.body.name, - email: req.body.email, - username: req.body.username, - password: bcrypt.hashSync(req.body.password) - }, - { - fields: ['name', 'email', 'username', 'password'] - } - ).then(() => { - res.send({ - "status": "success", - "message": "User has successfully edited", - "data": null - }); - }).catch(err => { - res.status(500).send({ + if (user === null) { + res.status(500).json({ + "status": "error", + "message": "User is not valid", + "data": null + }); + } else { + Role.findOne({ + where: { + name: req.body.role + } + }).then(role => { + if (role === null) { + res.status(500).json({ "status": "error", - "message": "Can not edit user", - "data": null + "message": "Role is not valid", + "data": null }); - }); + } else { + user.setRole(role).then(() => { + user.update( + { + name: req.body.name, + email: req.body.email, + username: req.body.username, + password: bcrypt.hashSync(req.body.password) + }, + { + fields: ['name', 'email', 'username', 'password'] + } + ).then(() => { + res.send({ + "status": "success", + "message": "User has successfully edited", + "data": null + }); + }).catch(err => { + res.status(500).send({ + "status": "error", + "message": "Can not edit user", + "data": null + }); + }); + }).catch(err => { + res.status(500).send({ + "status": "error", + "message": "Can not edit user", + "data": null + }); + }); + } }).catch(err => { - res.status(500).send({ + res.status(500).send({ "status": "error", "message": "Can not edit user", "data": null }); - }); - }).catch(err => { - res.status(500).send({ - "status": "error", - "message": "Can not edit user", - "data": null - }); - }); + }); + } }).catch(err => { res.status(500).send({ "status": "error", diff --git a/backend/router/checkPermission.js b/backend/router/checkPermission.js index 123e8e4b91478aa94bae7c6d5e285288b106ab73..7a1175be60bdd14385ca3aedc386cf0519d4712b 100644 --- a/backend/router/checkPermission.js +++ b/backend/router/checkPermission.js @@ -2,40 +2,6 @@ const models = require('../models'); const Role = models.role; const Permission = models.permission; -isRoleAll = (req, res, next) => { - Role.findAll({ - where: { - name: res.locals.role - }, - include: [{ - model: RoleHasPermission, - attributes: ['idRole', 'idPermission'], - include : [{ - model: Permission, - attributes: ['id', 'handles', 'permission'] - }] - }], - attributes: ['permission'] - }).then(permissions => { - if (permissions.includes('roleAll')) { - next(); - } else { - res.status(403).send({ - "status": "Error", - "message": "Access denied", - "data": null - }) - return; - } - }).catch(err => { - res.status(500).send({ - "status": "Error", - "message": "Can not access all role data", - "data": null - }) - }) -} - getPermission = async (req, res) => { var permissions = await getAllPermission(res.locals.role); res.send({ @@ -61,7 +27,6 @@ hasPermission = (permission) => { } const checkPermission = {}; -checkPermission.isRoleAll = isRoleAll; checkPermission.getPermission = getPermission; checkPermission.hasPermission = hasPermission; diff --git a/backend/router/router.js b/backend/router/router.js index 38a2c440e2d08e6f2eeae57e3f4722d15e2d2ca4..9b55dcec56e32cb44af4beb114c5fb449f055625 100644 --- a/backend/router/router.js +++ b/backend/router/router.js @@ -1,6 +1,8 @@ const verifySignUp = require('./verifySignUp'); const verifyJwtToken = require('./verifyJwtToken'); const verifyRole = require('./verifyRole'); +const verifyUser = require('./verifyUser'); +const verifyOrganisasi = require('./verifyOrganisasi') const checkPermission = require('./checkPermission'); const tokenHandler = require('../controller/tokenController'); @@ -10,6 +12,7 @@ module.exports = function(app) { const roleController = require('../controller/roleController.js'); const organisasiInternalController = require('../controller/organisasiInternalController.js'); const organisasiEksternalController = require('../controller/organisasiEksternalController.js'); + const permissionController = require('../controller/permissionController.js') // app.post('/api/auth/signup', [verifySignUp.checkDuplicateUserNameOrEmail, verifySignUp.checkRolesExisted], authController.signup); app.get('/', (req, res) => { @@ -20,24 +23,28 @@ module.exports = function(app) { app.get('/api/user/all', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User READONLY')], userController.fetchAll); app.get('/api/user/:id', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User READONLY')], userController.viewDetail); - app.post('/api/user/create', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User ALL')], userController.createUser); - app.post('/api/user/edit', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User ALL')], userController.editUser); + app.post('/api/user/create', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User ALL'), verifyUser.usernameIsExist, verifyUser.emailIsExist], userController.createUser); + app.post('/api/user/edit', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User ALL'), verifyUser.usernameEditChecking, verifyUser.emailEditChecking], userController.editUser); app.post('/api/user/delete', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User ALL')], userController.deleteUser); - app.post('/api/organisasi/internal/all', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi READONLY')], organisasiInternalController.fetchAll); - app.post('/api/organisasi/internal/create', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL')], organisasiInternalController.createOrganisasiInternal); - app.post('/api/organisasi/internal/edit', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL')], organisasiInternalController.editOrganisasiInternal); + app.get('/api/organisasi/internal/all', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi READONLY')], organisasiInternalController.fetchAll); + app.post('/api/organisasi/internal/create', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL'), verifyOrganisasi.internalIsExist], organisasiInternalController.createOrganisasiInternal); + app.post('/api/organisasi/internal/edit', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL'), verifyOrganisasi.internalEditChecking], organisasiInternalController.editOrganisasiInternal); app.post('/api/organisasi/internal/delete', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL')], organisasiInternalController.deleteOrganisasiInternal); - app.post('/api/organisasi/eksternal/all', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi READONLY')], organisasiEksternalController.fetchAll); - app.post('/api/organisasi/eksternal/create', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL')], organisasiEksternalController.createOrganisasiEksternal); - app.post('/api/organisasi/eksternal/edit', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL')], organisasiEksternalController.editOrganisasiEksternal); + app.get('/api/organisasi/eksternal/all', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi READONLY')], organisasiEksternalController.fetchAll); + app.post('/api/organisasi/eksternal/create', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL'), verifyOrganisasi.eksternalIsExist], organisasiEksternalController.createOrganisasiEksternal); + app.post('/api/organisasi/eksternal/edit', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL'), verifyOrganisasi.eksternalEditChecking], organisasiEksternalController.editOrganisasiEksternal); app.post('/api/organisasi/eksternal/delete', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Organisasi ALL')], organisasiEksternalController.deleteOrganisasiEksternal); - app.get('/api/role/all', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User READONLY')], roleController.fetchAll); - app.post('/api/role/create', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User ALL'), verifyRole.roleIsExist], roleController.createRole); - app.post('/api/role/edit', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User ALL'), verifyRole.roleIsExist], roleController.editRole); - app.post('/api/role/delete', [verifyJwtToken.verifyToken, checkPermission.hasPermission('User ALL')], roleController.deleteRole); + app.get('/api/role/all', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Role READONLY')], roleController.fetchAll); + app.post('/api/role/create', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Role ALL'), verifyRole.roleIsExist], roleController.createRole); + app.post('/api/role/edit', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Role ALL'), verifyRole.roleEditChecking], roleController.editRole); + app.post('/api/role/delete', [verifyJwtToken.verifyToken, checkPermission.hasPermission('Role ALL')], roleController.deleteRole); + + app.get('/api/permission/all', [verifyJwtToken.verifyToken], permissionController.fetchAllPermission); + app.get('/api/permission/:id', [verifyJwtToken.verifyToken], permissionController.fetchPermissionList); + app.post('/api/permission/edit', [verifyJwtToken.verifyToken], permissionController.editPermission); /* * How to use checkPermission.hasPermission diff --git a/backend/router/verifyOrganisasi.js b/backend/router/verifyOrganisasi.js new file mode 100644 index 0000000000000000000000000000000000000000..73f0876fe8dde9dab8b61c56bae5b6268427951c --- /dev/null +++ b/backend/router/verifyOrganisasi.js @@ -0,0 +1,118 @@ +const models = require('../models'); +const Organisasi = models.organisasi; + +internalIsExist = (req, res, next) => { + Organisasi.findAll({ + attributes: ['id', 'name'], + where: { + name: req.body.name, + jenis: "Internal" + } + }).then(organisasi => { + if (organisasi.length == 0) { + next(); + } else { + res.status(500).send({ + "status": "error", + "message": "Organisasi is exist", + "data": null + }); + return; + } + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all organisasi data", + "data": null + }); + }) +} + +eksternalIsExist = (req, res, next) => { + Organisasi.findAll({ + attributes: ['id', 'name'], + where: { + name: req.body.name, + jenis: "Eksternal" + } + }).then(organisasi => { + if (organisasi.length == 0) { + next(); + } else { + res.status(500).send({ + "status": "error", + "message": "Organisasi is exist", + "data": null + }); + return; + } + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all organisasi data", + "data": null + }); + }) +} + +internalEditChecking = (req, res, next) => { + Organisasi.findOne({ + where: { + id: req.body.id + } + }).then(organisasi => { + if (organisasi === null) { + res.status(500).json({ + "status": "error", + "message": "Organisasi is not valid", + "data": null + }); + return; + } else if (organisasi.name === req.body.name) { + next(); + } else { + internalIsExist(req, res, next); + } + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all organisasi data", + "data": null + }); + }); +} + +eksternalEditChecking = (req, res, next) => { + Organisasi.findOne({ + where: { + id: req.body.id + } + }).then(organisasi => { + if (organisasi === null) { + res.status(500).json({ + "status": "error", + "message": "Organisasi is not valid", + "data": null + }); + return; + } else if (organisasi.name === req.body.name) { + next(); + } else { + eksternalIsExist(req, res, next); + } + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all organisasi data", + "data": null + }); + }); +} + +const verifyOrganisasi = {}; +verifyOrganisasi.internalIsExist = internalIsExist; +verifyOrganisasi.eksternalIsExist = eksternalIsExist; +verifyOrganisasi.internalEditChecking = internalEditChecking; +verifyOrganisasi.eksternalEditChecking = eksternalEditChecking; + +module.exports = verifyOrganisasi; \ No newline at end of file diff --git a/backend/router/verifyRole.js b/backend/router/verifyRole.js index ca28c76d62b839ab167ce31e2137bcb80f4413e2..b550f96b95cc032a1b0f96b17cc3ffd1c9ba9eae 100644 --- a/backend/router/verifyRole.js +++ b/backend/router/verifyRole.js @@ -12,7 +12,7 @@ roleIsExist = (req, res, next) => { next(); } else { res.status(500).send({ - "status": "Error", + "status": "error", "message": "Role is exist", "data": null }); @@ -27,7 +27,35 @@ roleIsExist = (req, res, next) => { }) } +roleEditChecking = (req, res, next) => { + Role.findOne({ + where: { + id: req.body.id + } + }).then(role => { + if (role === null) { + res.status(500).json({ + "status": "error", + "message": "Role is not valid", + "data": null + }); + return; + } else if (role.name === req.body.name) { + next(); + } else { + roleIsExist(req, res, next); + } + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all role data", + "data": null + }); + }); +} + const verifyRole = {}; verifyRole.roleIsExist = roleIsExist; +verifyRole.roleEditChecking = roleEditChecking; module.exports = verifyRole; \ No newline at end of file diff --git a/backend/router/verifyUser.js b/backend/router/verifyUser.js new file mode 100644 index 0000000000000000000000000000000000000000..9355289fbfa10388ec1797d9c192e65076a16ac6 --- /dev/null +++ b/backend/router/verifyUser.js @@ -0,0 +1,116 @@ +const models = require('../models'); +const User = models.user; + +usernameIsExist = (req, res, next) => { + User.findAll({ + attributes: ['id', 'username'], + where: { + username: req.body.username + } + }).then(users => { + if (users.length == 0) { + next(); + } else { + res.status(500).send({ + "status": "error", + "message": "Username is exist", + "data": null + }); + return; + } + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all user data", + "data": null + }); + }); +} + +emailIsExist = (req, res, next) => { + User.findAll({ + attributes: ['id', 'email'], + where: { + email: req.body.email + } + }).then(users => { + if (users.length == 0) { + next(); + } else { + res.status(500).send({ + "status": "error", + "message": "Email is exist", + "data": null + }); + return; + } + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all user data", + "data": null + }); + }); +} + +usernameEditChecking = (req, res, next) => { + User.findOne({ + where: { + id: req.body.id + } + }).then(user => { + if (user === null) { + res.status(500).json({ + "status": "error", + "message": "User is not valid", + "data": null + }); + return; + } else if (user.username === req.body.username) { + next(); + } else { + usernameIsExist(req, res, next); + } + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all user data", + "data": null + }); + }); +} + +emailEditChecking = (req, res, next) => { + User.findOne({ + where: { + id: req.body.id + } + }).then(user => { + if (user === null) { + res.status(500).json({ + "status": "error", + "message": "User is not valid", + "data": null + }); + return; + } else if (user.email === req.body.email) { + next(); + } else { + emailIsExist(req, res, next); + } + }).catch(err => { + res.status(500).json({ + "status": "error", + "message": "Can not access all user data", + "data": null + }); + }); +} + +const verifyUser = {}; +verifyUser.usernameIsExist = usernameIsExist; +verifyUser.emailIsExist = emailIsExist; +verifyUser.usernameEditChecking = usernameEditChecking; +verifyUser.emailEditChecking = emailEditChecking; + +module.exports = verifyUser; \ No newline at end of file diff --git a/backend/seeders/20190515095039-seed-permission.js b/backend/seeders/20190515095039-seed-permission.js index 4669c8c2981007333ac6ef664bce8f33b9f9a577..302446fb321aa62970fa8f7ca8f99178de65807c 100644 --- a/backend/seeders/20190515095039-seed-permission.js +++ b/backend/seeders/20190515095039-seed-permission.js @@ -34,6 +34,14 @@ module.exports = { name: 'Organisasi ALL', createdAt: new Date(), updatedAt : new Date() + },{ + name: 'Role READONLY', + createdAt: new Date(), + updatedAt : new Date() + },{ + name: 'Role ALL', + createdAt: new Date(), + updatedAt : new Date() }]); }, diff --git a/backend/seeders/20190515095511-seed-role_permission.js b/backend/seeders/20190515095511-seed-role_permission.js index 8a1cbfd6556dc6e569e07ea6632646551824732a..929e2f19f8f4ba108745d106bed49b8a73db2da0 100644 --- a/backend/seeders/20190515095511-seed-role_permission.js +++ b/backend/seeders/20190515095511-seed-role_permission.js @@ -27,6 +27,11 @@ module.exports = { permissionId: permissionRow[7].id, createdAt: new Date(), updatedAt: new Date() + },{ + roleId: roleRow[0].id, + permissionId: permissionRow[9].id, + createdAt: new Date(), + updatedAt: new Date() },{ roleId: roleRow[0].id, permissionId: permissionRow[0].id, @@ -47,6 +52,11 @@ module.exports = { permissionId: permissionRow[6].id, createdAt: new Date(), updatedAt: new Date() + },{ + roleId: roleRow[0].id, + permissionId: permissionRow[8].id, + createdAt: new Date(), + updatedAt: new Date() },{ roleId: roleRow[1].id, permissionId: permissionRow[0].id, @@ -67,6 +77,11 @@ module.exports = { permissionId: permissionRow[6].id, createdAt: new Date(), updatedAt: new Date() + },{ + roleId: roleRow[1].id, + permissionId: permissionRow[8].id, + createdAt: new Date(), + updatedAt: new Date() }]) },