"feat: refactor API handlers to use services, add logging, and improve security checks"

03_source/cms_backend/src/app/api/auth/me/route.ts

@@ -1,13 +1,20 @@
+import type { User } from '@prisma/client';
+import type { NextRequest } from 'next/server';
+
 import { headers } from 'next/headers';
 
 import { verify } from 'src/utils/jwt';
 import { STATUS, response, handleError } from 'src/utils/response';
 
-import { _users, JWT_SECRET } from 'src/_mock/_auth';
+import { JWT_SECRET } from 'src/_mock/_auth';
+import { getUserById } from 'src/app/services/user.service';
+import { createAccessLog } from 'src/app/services/AccessLog.service';
+
+import { flattenNextjsRequest } from '../sign-in/flattenNextjsRequest';
 
 // ----------------------------------------------------------------------
 
-export const runtime = 'edge';
+// export const runtime = 'edge';
 
 /**
  * This API is used for demo purpose only
@@ -17,25 +24,44 @@ export const runtime = 'edge';
  * You should not expose the JWT_SECRET in the client side
  */
 
-export async function GET() {
+const USER_TOKEN_CHECK_FAILED = 'user token check failed';
+const INVALID_AUTH_TOKEN = 'Invalid authorization token';
+const USER_ID_NOT_FOUND = 'userId not found';
+const USER_TOKEN_OK = 'user token check ok';
+const AUTHORIZATION_TOKEN_MISSING_OR_INVALID = 'Authorization token missing or invalid';
+
+export async function GET(req: NextRequest) {
+  const debug = { 'req.headers': flattenNextjsRequest(req) };
+
   try {
     const headersList = headers();
     const authorization = headersList.get('authorization');
 
     if (!authorization || !authorization.startsWith('Bearer ')) {
-      return response({ message: 'Authorization token missing or invalid' }, STATUS.UNAUTHORIZED);
+      return response({ message: AUTHORIZATION_TOKEN_MISSING_OR_INVALID }, STATUS.UNAUTHORIZED);
     }
 
     const accessToken = `${authorization}`.split(' ')[1];
     const data = await verify(accessToken, JWT_SECRET);
+    console.log(data.userId);
 
-    const currentUser = _users.find((user) => user.id === data.userId);
+    if (data.userId) {
+      // TODO: remove me
+      // const currentUser = _users.find((user) => user.id === data.userId);
+      const currentUser: User | null = await getUserById(data.userId);
 
-    if (!currentUser) {
-      return response({ message: 'Invalid authorization token' }, STATUS.UNAUTHORIZED);
+      if (!currentUser) {
+        createAccessLog('', USER_TOKEN_CHECK_FAILED, debug);
+
+        return response({ message: INVALID_AUTH_TOKEN }, STATUS.UNAUTHORIZED);
+      }
+
+      createAccessLog(currentUser.id, USER_TOKEN_OK, debug);
+
+      return response({ user: currentUser }, STATUS.OK);
+    } else {
+      return response({ message: USER_ID_NOT_FOUND }, STATUS.ERROR);
     }
-
-    return response({ user: currentUser }, 200);
   } catch (error) {
     return handleError('[Auth] - Me', error);
   }

03_source/cms_backend/src/app/api/auth/me/test.http

@@ -0,0 +1,25 @@
+###
+# username and password ok
+GET http://localhost:7272/api/auth/me
+Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJjbWJnbnUyengwMDBjaHEzaGZ3dmtjejlvIiwiaWF0IjoxNzQ4OTY0ODkyLCJleHAiOjE3NTAxNzQ0OTJ9.lo04laCxtm0IVeYaETEV3hXKyDmXPEn7SyWtY2VR4dI
+
+
+###
+# There is no user corresponding to the email address.
+POST http://localhost:7272/api/auth/sign-in
+content-type: application/json
+
+{
+    "email": "demo@minimals1.cc",
+    "password": "@2Minimal"
+}
+
+###
+# Wrong password
+POST http://localhost:7272/api/auth/sign-in
+content-type: application/json
+
+{
+    "email": "demo@minimals.cc",
+    "password": "@2Min111imal"
+}

03_source/cms_backend/src/app/api/auth/sign-in/flattenNextjsRequest.ts

@@ -0,0 +1,5 @@
+import type { NextRequest } from 'next/server';
+
+export function flattenNextjsRequest(req: NextRequest) {
+  return Object.fromEntries(req.headers.entries());
+}

03_source/cms_backend/src/app/api/auth/sign-in/route.ts

@@ -7,6 +7,7 @@ import { JWT_SECRET, JWT_EXPIRES_IN } from 'src/_mock/_auth';
 import { createAccessLog } from 'src/app/services/AccessLog.service';
 
 import prisma from '../../../lib/prisma';
+import { flattenNextjsRequest } from './flattenNextjsRequest';
 
 // ----------------------------------------------------------------------
 
@@ -22,7 +23,7 @@ const ERR_USER_NOT_FOUND = 'There is no user corresponding to the email address.
 const ERR_WRONG_PASSWORD = 'Wrong password';
 
 export async function POST(req: NextRequest) {
-  const debug = { 'req.headers': Object.fromEntries(req.headers.entries()) };
+  const debug = { 'req.headers': flattenNextjsRequest(req) };
 
   try {
     const { email, password } = await req.json();