Commit 6c3a0e5b authored by Benjamin Bouvier's avatar Benjamin Bouvier
Browse files

Add validation checks for Access creation and update;

parent 58ed0e20
......@@ -93,12 +93,6 @@ export function init() {
});
}
export function deleteAccess(accessId) {
return buildFetchPromise(`api/${API_VERSION}/accesses/${accessId}`, {
method: 'DELETE'
});
}
export function deleteOperation(opId) {
return buildFetchPromise(`api/${API_VERSION}/operations/${opId}`, {
method: 'DELETE'
......@@ -185,10 +179,6 @@ export function mergeOperations(toKeepId, toRemoveId) {
});
}
export function getNewOperations(accessId) {
return buildFetchPromise(`api/${API_VERSION}/accesses/${accessId}/fetch/operations`);
}
export function createOperation(operation) {
return buildFetchPromise(`api/${API_VERSION}/operations/`, {
method: 'POST',
......@@ -199,10 +189,6 @@ export function createOperation(operation) {
});
}
export function getNewAccounts(accessId) {
return buildFetchPromise(`api/${API_VERSION}/accesses/${accessId}/fetch/accounts`);
}
export function updateWeboob() {
return buildFetchPromise(`api/${API_VERSION}/settings/weboob/`, {
method: 'PUT'
......@@ -260,23 +246,35 @@ export function sendTestEmail(email) {
});
}
export function updateAndFetchAccess(accessId, access) {
if (access.customFields) {
assert(access.customFields instanceof Array);
// Note this is correct even if the array is empty.
access.customFields = JSON.stringify(access.customFields);
export function createAccess(bank, login, password, customFields, customLabel) {
let data = {
bank,
login,
password,
customLabel
};
if (customFields && customFields.length) {
assert(customFields instanceof Array);
data.customFields = JSON.stringify(customFields);
}
return buildFetchPromise(`api/${API_VERSION}/accesses/${accessId}/fetch/accounts`, {
method: 'PUT',
return buildFetchPromise(`api/${API_VERSION}/accesses/`, {
method: 'POST',
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(access)
body: JSON.stringify(data)
});
}
export function updateAccess(accessId, update) {
let error = checkAllowedFields(update, ['enabled', 'customLabel']);
if (error) {
alert(`Developer error when updating an access: ${error}`);
return;
}
return buildFetchPromise(`api/${API_VERSION}/accesses/${accessId}`, {
method: 'PUT',
headers: {
......@@ -286,25 +284,39 @@ export function updateAccess(accessId, update) {
});
}
export function createAccess(bank, login, password, customFields, customLabel) {
let data = {
bank,
login,
password,
customLabel
};
export function updateAndFetchAccess(accessId, access) {
let error = checkAllowedFields(access, ['enabled', 'login', 'password', 'customFields']);
if (error) {
alert(`Developer error when updating an access: ${error}`);
return;
}
if (customFields && customFields.length) {
assert(customFields instanceof Array);
data.customFields = JSON.stringify(customFields);
if (access.customFields) {
assert(access.customFields instanceof Array);
// Note this is correct even if the array is empty.
access.customFields = JSON.stringify(access.customFields);
}
return buildFetchPromise(`api/${API_VERSION}/accesses/`, {
method: 'POST',
return buildFetchPromise(`api/${API_VERSION}/accesses/${accessId}/fetch/accounts`, {
method: 'PUT',
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(data)
body: JSON.stringify(access)
});
}
export function getNewAccounts(accessId) {
return buildFetchPromise(`api/${API_VERSION}/accesses/${accessId}/fetch/accounts`);
}
export function getNewOperations(accessId) {
return buildFetchPromise(`api/${API_VERSION}/accesses/${accessId}/fetch/operations`);
}
export function deleteAccess(accessId) {
return buildFetchPromise(`api/${API_VERSION}/accesses/${accessId}`, {
method: 'DELETE'
});
}
......
......@@ -8,6 +8,7 @@ import { fullPoll } from '../../lib/poller';
import * as AccountController from './accounts';
import { asyncErr, getErrorCode, KError, makeLogger } from '../../helpers';
import { checkHasAllFields, checkAllowedFields } from '../../shared/validators';
let log = makeLogger('controllers/accesses');
......@@ -71,15 +72,24 @@ function sanitizeCustomFields(access) {
// retrieves its accounts and operations.
export async function create(req, res) {
let access;
let createdAccess = false,
retrievedAccounts = false;
let createdAccess = false;
let retrievedAccounts = false;
let { id: userId } = req.user;
try {
let params = req.body;
if (!params.bank || !params.login || !params.password) {
throw new KError('missing parameters', 400);
let error =
checkHasAllFields(params, ['bank', 'login', 'password']) ||
checkAllowedFields(params, [
'bank',
'login',
'password',
'customFields',
'customLabel'
]);
if (error) {
throw new KError(`when creating a new access: ${error}`, 400);
}
access = await Accesses.create(userId, sanitizeCustomFields(params));
......@@ -198,17 +208,22 @@ export async function update(req, res) {
try {
let { id: userId } = req.user;
let { access } = req.preloaded;
let accessUpdate = req.body;
if (accessUpdate.enabled === false) {
accessUpdate.password = null;
let newFields = req.body;
let error = checkAllowedFields(newFields, ['enabled', 'customLabel']);
if (error) {
throw new KError(`when updating an access: ${error}`, 400);
}
if (accessUpdate.customLabel === '') {
accessUpdate.customLabel = null;
if (newFields.enabled === false) {
newFields.password = null;
}
if (newFields.customLabel === '') {
newFields.customLabel = null;
}
await Accesses.update(userId, access.id, sanitizeCustomFields(accessUpdate));
await Accesses.update(userId, access.id, sanitizeCustomFields(newFields));
res.status(201).json({ status: 'OK' });
} catch (err) {
return asyncErr(res, err, 'when updating bank access');
......@@ -219,13 +234,19 @@ export async function updateAndFetchAccounts(req, res) {
try {
let { id: userId } = req.user;
let { access } = req.preloaded;
let accessUpdate = req.body;
let newFields = req.body;
let error = checkAllowedFields(newFields, ['enabled', 'login', 'password', 'customFields']);
if (error) {
throw new KError(`when updating and polling an access: ${error}`, 400);
}
// The preloaded access needs to be updated before calling fetchAccounts.
req.preloaded.access = await Accesses.update(
userId,
access.id,
sanitizeCustomFields(accessUpdate)
sanitizeCustomFields(newFields)
);
await fetchAccounts(req, res);
} catch (err) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment