From 9ce5bb398f238458c70cb89401981121fb1cc883 Mon Sep 17 00:00:00 2001 From: Quan HL Date: Fri, 16 Jun 2023 06:17:51 +0700 Subject: [PATCH] encrypt client password and fix upgrade db script --- db/jambones-sql.sql | 2 +- db/jambones.sqs | 86 ++++++++++++++++++++------------------- db/upgrade-jambonz-db.js | 4 +- lib/routes/api/clients.js | 8 +++- test/clients.js | 2 + 5 files changed, 54 insertions(+), 48 deletions(-) diff --git a/db/jambones-sql.sql b/db/jambones-sql.sql index e06859d..63ba4d3 100644 --- a/db/jambones-sql.sql +++ b/db/jambones-sql.sql @@ -135,7 +135,7 @@ client_sid CHAR(36) NOT NULL UNIQUE , account_sid CHAR(36) NOT NULL, is_active BOOLEAN NOT NULL DEFAULT 1, username VARCHAR(64), -password VARCHAR(64), +password VARCHAR(1024), PRIMARY KEY (client_sid) ); diff --git a/db/jambones.sqs b/db/jambones.sqs index d241d5b..b448bf6 100644 --- a/db/jambones.sqs +++ b/db/jambones.sqs @@ -87,7 +87,7 @@ - + @@ -148,7 +148,7 @@ - + @@ -225,7 +225,7 @@ - + @@ -279,7 +279,7 @@ - + @@ -316,7 +316,7 @@ - + @@ -471,7 +471,7 @@ - + @@ -537,7 +537,7 @@ - + @@ -737,7 +737,7 @@ - + @@ -819,7 +819,7 @@ - + @@ -872,7 +872,7 @@ - + @@ -999,7 +999,7 @@ - + @@ -1020,7 +1020,7 @@ - + @@ -1081,7 +1081,7 @@ - + @@ -1133,7 +1133,7 @@ - + @@ -1183,7 +1183,7 @@ - + @@ -1283,7 +1283,7 @@ - + @@ -1352,7 +1352,7 @@ - + @@ -1389,7 +1389,7 @@ - + @@ -1427,7 +1427,7 @@ - + @@ -1459,7 +1459,7 @@ - + @@ -1536,7 +1536,7 @@ - + @@ -1607,7 +1607,7 @@ - + @@ -1821,7 +1821,7 @@ - + @@ -1860,7 +1860,7 @@ - + @@ -1952,7 +1952,7 @@ - + @@ -2022,7 +2022,7 @@ - + @@ -2074,7 +2074,7 @@ - + @@ -2188,7 +2188,7 @@ - + @@ -2243,9 +2243,11 @@ - - + + + + @@ -2351,7 +2353,7 @@ - + @@ -2532,7 +2534,7 @@ - + @@ -2640,7 +2642,7 @@ - + @@ -2671,7 +2673,7 @@ - + @@ -2756,7 +2758,7 @@ - + @@ -2816,7 +2818,7 @@ - + @@ -2883,7 +2885,7 @@ - + @@ -2957,16 +2959,16 @@ - + - + - - - + + + diff --git a/db/upgrade-jambonz-db.js b/db/upgrade-jambonz-db.js index c233e8a..eed3338 100644 --- a/db/upgrade-jambonz-db.js +++ b/db/upgrade-jambonz-db.js @@ -146,9 +146,7 @@ const sql = { 'alter table accounts add column record_format VARCHAR(16) NOT NULL DEFAULT `mp3`', 'alter table applications add column record_all_calls BOOLEAN NOT NULL DEFAULT false', 'alter table phone_numbers DROP INDEX number', - 'create unique index phone_numbers_unique_idx_voip_carrier_number ON phone_numbers (number,voip_carrier_sid)' - ], - 8005: [ + 'create unique index phone_numbers_unique_idx_voip_carrier_number ON phone_numbers (number,voip_carrier_sid)', `CREATE TABLE clients ( client_sid CHAR(36) NOT NULL UNIQUE , diff --git a/lib/routes/api/clients.js b/lib/routes/api/clients.js index 4c80fc3..de3ea9a 100644 --- a/lib/routes/api/clients.js +++ b/lib/routes/api/clients.js @@ -4,6 +4,7 @@ const sysError = require('../error'); const Client = require('../../models/client'); const Account = require('../../models/account'); const { DbErrorBadRequest, DbErrorForbidden } = require('../../utils/errors'); +const { encrypt, decrypt } = require('../../utils/encrypt-decrypt'); const commonCheck = async(req) => { if (req.user.hasAccountAuth) { @@ -15,6 +16,9 @@ const commonCheck = async(req) => { } } + if (req.body.password) { + req.body.password = encrypt(req.body.password); + } }; const validateAdd = async(req) => { @@ -51,7 +55,7 @@ router.get('/', async(req, res) => { await Client.retrieveAllByAccountSid(req.user.hasAccountAuth ? req.user.account_sid : null) : await Client.retrieveAllByServiceProviderSid(req.user.service_provider_sid); const ret = results.map((c) => { - delete c.password; + c.password = decrypt(c.password); return c; }); res.status(200).json(ret); @@ -66,7 +70,7 @@ router.get('/:sid', async(req, res) => { const results = await Client.retrieve(req.params.sid); if (results.length === 0) return res.sendStatus(404); const client = results[0]; - delete client.password; + client.password = decrypt(client.password); if (req.user.hasAccountAuth && client.account_sid !== req.user.account_sid) { return res.sendStatus(404); } else if (req.user.hasServiceProviderAuth) { diff --git a/test/clients.js b/test/clients.js index 1534d35..f098d4d 100644 --- a/test/clients.js +++ b/test/clients.js @@ -76,6 +76,7 @@ test('client test', async(t) => { t.ok(result.client_sid, 'successfully retrieved Client by sid'); t.ok(result.username === 'client1', 'successfully retrieved Client by sid'); t.ok(result.is_active === 1 , 'successfully retrieved Client by sid'); + t.ok(result.password === 'sdf12412' , 'successfully retrieved Client by sid'); /* update the entity */ result = await request.put(`/Clients/${sid}`, { @@ -93,6 +94,7 @@ test('client test', async(t) => { json: true, }); t.ok(result.is_active === 0 , 'successfully updated Client'); + t.ok(result.password === 'sdf12412' , 'successfully retrieved Client by sid'); /* delete Client */ result = await request.delete(`/Clients/${sid}`, {