Backendbranch

backend/api/auth/validateAPIKey.ts

@@ -0,0 +1,55 @@
+// mysql connection
+var { mysql_pool } = require("../../database/database.ts");
+
+// validateAPIKey
+exports.validateAPIKey = (req, res, next) => {
+  // input: key
+  // output: api authentication error
+
+  var error = "";
+  var results = [];
+  var responseCode = 500;
+  const developerKey = req.header("X-API-Key");
+
+  mysql_pool.getConnection(function (err, connection) {
+    if (err) {
+      console.log(err);
+      // return with error
+      res.status(responseCode).json({
+        result: results,
+        error: "Unauthorized: API Authentication Error",
+      });
+    } else {
+      connection.query(
+        "SELECT * FROM developers WHERE developerKey=?",
+        [developerKey],
+        function (err, result) {
+          if (err) {
+            error = "Unauthorized: API Authentication Error";
+            responseCode = 401;
+            console.log(err);
+            sendData();
+          } else {
+            if (result[0]) {
+              next();
+            } else {
+              error = "Unauthorized: API Authentication Error";
+              responseCode = 401;
+              sendData();
+            }
+          }
+          function sendData() {
+            // package data
+            var ret = {
+              result: results,
+              error: error,
+            };
+            // send data
+            res.status(responseCode).json(ret);
+          }
+          connection.release();
+        }
+      );
+    }
+  });
+};

backend/api/controllers/contentControllers/getHomefeedContentInBatchesController.ts

@@ -38,7 +38,8 @@ exports.getHomefeedContentInBatches = async (req, res) => {
   if (tagArray && tagArray.length > 0) {
     insertString += "INNER JOIN (SELECT * FROM contentTag WHERE ";
     for (var tag of tagArray) {
-      insertString += "tagID=" + tag.id + " OR ";
+      insertString += "tagID=? OR ";
+      insertArray.push(tag.id);
     }
     insertString = insertString.slice(0, -3);
     insertString += ") AS ct1 ON ct1.contentID=content.id ";
@@ -66,7 +67,8 @@ exports.getHomefeedContentInBatches = async (req, res) => {
       insertString += "WHERE ";
       for (var contentT of contentTypeArray) {
         if (contentT !== "contest") {
-          insertString += `contentType='${contentT}' OR `;
+          insertString += `contentType=? OR `;
+          insertArray.push(contentT);
         }
       }
       insertString += " isContest=1 ";
@@ -106,7 +108,7 @@ exports.getHomefeedContentInBatches = async (req, res) => {
           responseCode = 200;
         } else {
           error = "Content does not exist";
-          responseCode = 500;
+          responseCode = 200;
         }
       }
       var ret = {

backend/api/controllers/contentControllers/updateContentController.ts

@@ -307,7 +307,9 @@ exports.updateContent = async (req, res) => {
                           var updatedTagsStringUsedForDeletion = "";
                           for (var i = 0; i < tagArray.length; ++i) {
                             updatedTagsStringUsedForDeletion +=
-                              "tagID=" + tagArray[i].id + " OR ";
+                              "tagID=" +
+                              connection.escape(tagArray[i].id) +
+                              " OR ";
                             sqlQuery(i);
                             function sqlQuery(index) {
                               mysql_pool.getConnection(function (

backend/api/routes/commentRoutes.ts

@@ -1,4 +1,5 @@
 // Routes for comments
+var apiAuth = require("../auth/validateAPIKey.ts");
 var express = require("express");
 var router = express.Router();
 
@@ -10,15 +11,40 @@ const getCommentsController = require("../controllers/commentControllers/getComm
 const approveCommentController = require("../controllers/commentControllers/approveCommentController.ts");
 const getCommentsForContentController = require("../controllers/commentControllers/getCommentsForContentController.ts");
 
-router.post("/api/createComment", createCommentController.createComment);
-router.post("/api/readComment", readCommentController.readComment);
+router.post(
+  "/api/createComment",
+  apiAuth.validateAPIKey,
+  createCommentController.createComment
+);
+router.post(
+  "/api/readComment",
+  apiAuth.validateAPIKey,
+  readCommentController.readComment
+);
 router.post(
   "/api/getCommentsForContent",
+  apiAuth.validateAPIKey,
   getCommentsForContentController.getCommentsForContent
 );
-router.patch("/api/updateComment", updateCommentController.updateComment);
-router.patch("/api/approveComment", approveCommentController.approveComment);
-router.delete("/api/deleteComment", deleteCommentController.deleteComment);
-router.get("/api/getComments", getCommentsController.getComments);
+router.patch(
+  "/api/updateComment",
+  apiAuth.validateAPIKey,
+  updateCommentController.updateComment
+);
+router.patch(
+  "/api/approveComment",
+  apiAuth.validateAPIKey,
+  approveCommentController.approveComment
+);
+router.delete(
+  "/api/deleteComment",
+  apiAuth.validateAPIKey,
+  deleteCommentController.deleteComment
+);
+router.get(
+  "/api/getComments",
+  apiAuth.validateAPIKey,
+  getCommentsController.getComments
+);
 
 module.exports = router;

backend/api/routes/contentRoutes.ts

@@ -1,4 +1,5 @@
 // Routes for content
+var apiAuth = require("../auth/validateAPIKey.ts");
 var express = require("express");
 var router = express.Router();
 
@@ -14,33 +15,59 @@ const getContentByTypeInBatchesController = require("../controllers/contentContr
 const getHomefeedContentInBatchesController = require("../controllers/contentControllers/getHomefeedContentInBatchesController.ts");
 const createContentWithTagsController = require("../controllers/contentControllers/createContentWithTagsController.ts");
 
-router.post("/api/createContent", createContentController.createContent);
+router.post(
+  "/api/createContent",
+  apiAuth.validateAPIKey,
+  createContentController.createContent
+);
 router.post(
   "/api/createContentAndTag",
+  apiAuth.validateAPIKey,
   createContentAndTagController.createContentAndTag
 );
 router.post(
   "/api/createContentWithTags",
+  apiAuth.validateAPIKey,
   createContentWithTagsController.createContentWithTags
 );
 router.post(
   "/api/getContentByTypeInBatches",
+  apiAuth.validateAPIKey,
   getContentByTypeInBatchesController.getContentByTypeInBatches
 );
 router.post(
   "/api/getHomefeedContentInBatches",
+  apiAuth.validateAPIKey,
   getHomefeedContentInBatchesController.getHomefeedContentInBatches
 );
-router.post("/api/readContent", readContentController.readContent);
-router.patch("/api/updateContent", updateContentController.updateContent);
-router.delete("/api/deleteContent", deleteContentController.deleteContent);
-router.get("/api/getContents", getContentController.getContents);
+router.post(
+  "/api/readContent",
+  apiAuth.validateAPIKey,
+  readContentController.readContent
+);
+router.patch(
+  "/api/updateContent",
+  apiAuth.validateAPIKey,
+  updateContentController.updateContent
+);
+router.delete(
+  "/api/deleteContent",
+  apiAuth.validateAPIKey,
+  deleteContentController.deleteContent
+);
+router.get(
+  "/api/getContents",
+  apiAuth.validateAPIKey,
+  getContentController.getContents
+);
 router.post(
   "/api/getContentByType",
+  apiAuth.validateAPIKey,
   getContentByTypeController.getContentByType
 );
 router.post(
   "/api/getUserContentByType",
+  apiAuth.validateAPIKey,
   getUserContentByTypeController.getUserContentByType
 );
 

backend/api/routes/contentTagRoutes.ts

@@ -1,4 +1,5 @@
 // Routes for content tags
+var apiAuth = require("../auth/validateAPIKey.ts");
 var express = require("express");
 var router = express.Router();
 
@@ -12,28 +13,38 @@ const removeTagsFromContentController = require("../controllers/contentTagContro
 
 router.post(
   "/api/createContentTag",
+  apiAuth.validateAPIKey,
   createContentTagController.createContentTag
 );
 router.post(
   "/api/addTagsToContent",
+  apiAuth.validateAPIKey,
   addTagsToContentController.addTagsToContent
 );
 router.post(
   "/api/getTagsForContent",
+  apiAuth.validateAPIKey,
   getTagsForContentController.getTagsForContent
 );
 router.patch(
   "/api/updateContentTag",
+  apiAuth.validateAPIKey,
   updateContentTagController.updateContentTag
 );
 router.delete(
   "/api/deleteContentTag",
+  apiAuth.validateAPIKey,
   deleteContentTagController.deleteContentTag
 );
 router.delete(
   "/api/removeTagsFromContent",
+  apiAuth.validateAPIKey,
   removeTagsFromContentController.removeTagsFromContent
 );
-router.get("/api/getContentTags", getContentTagsController.getContentTags);
+router.get(
+  "/api/getContentTags",
+  apiAuth.validateAPIKey,
+  getContentTagsController.getContentTags
+);
 
 module.exports = router;