some minimal authorisation system

server/.env.example

@@ -2,3 +2,7 @@ PORT=3000
 DB_USERNAME=example_name
 DB_PASSWORD=example_password
 DB_DOMAIN=example.com:1234/example_name
+
+AUTH0_DOMAIN=auth0-domain
+AUTH0_AUDIENCE=auth0-audience
+AUTH0_ISSUER=auth0-issuer

server/src/index.js

@@ -4,6 +4,8 @@ import cors from 'cors'
 import mongoose from 'mongoose'
 import graphqlHTTP from 'express-graphql'
 import expressPlayground from 'graphql-playground-middleware-express'
+import jwt from 'express-jwt'
+import jwksRsa from 'jwks-rsa'
 
 import schema from './schema'
 
@@ -29,9 +31,30 @@ db.on('error', () => { console.error.bind(console, 'MongoDB connection error:')
 db.once('open', () => { console.log('Connected to the DB.') })
 
 /* -------------------------------------------------
------------------ Graphql setup --------------------
+------------- Authentification setup ---------------
 ------------------------------------------------- */
 
+app.use('/graphql',
+  jwt({
+    secret: jwksRsa.expressJwtSecret({
+      cache: true,
+      rateLimit: true,
+      jwksRequestsPerMinute: 1,
+      jwksUri: `https://${process.env.AUTH0_DOMAIN}/.well-known/jwks.json`
+    }),
+    credentialsRequired: false,
+    audience: process.env.AUTH0_AUDIENCE,
+    issuer: process.env.AUTH0_ISSUER,
+    algorithms: [`RS256`]
+  }),
+  function (req, res, next) {
+    return next()
+  }
+)
+
+/* -------------------------------------------------
+----------------- Graphql setup --------------------
+------------------------------------------------- */
 app.use('/graphql', graphqlHTTP(req => {
   return {
     schema: schema,

server/src/schema/mutations/AddPrize.js

@@ -14,11 +14,11 @@ const args = {
 }
 
 const resolve = (parent, { competitionCodeName, position, algoPrize }, context) => {
-  // let authIdOnSession = context.user.sub
   return new Promise((resolve, reject) => {
-    Competition.findOne({ codeName: competitionCodeName }).exec((err, competition) => {
-      if (err) reject(err)
-      else {
+    Competition.findOne({ codeName: competitionCodeName, host: context.user.sub }).exec((err, competition) => {
+      if (err || !competition) {
+        reject(err)
+      } else {
         if (competition.prizes.some(prize => prize.position === position)) {
           // need to add an error message here TODO
           resolve(competition)

server/src/schema/mutations/AddRule.js

@@ -13,13 +13,12 @@ const args = {
 }
 
 const resolve = (parent, { competitionCodeName, title, description }, context) => {
-  // let authIdOnSession = context.user.sub
   return new Promise((resolve, reject) => {
-    Competition.findOne({ codeName: competitionCodeName }).exec((err, competition) => {
-      if (err) reject(err)
-      else {
+    Competition.findOne({ codeName: competitionCodeName, host: context.user.sub }).exec((err, competition) => {
+      if (err || !competition) {
+        reject(err)
+      } else {
         if (competition.rules.some(rule => rule.title === title)) {
-          // need to add an error message here TODO
           resolve(competition)
         } else {
           let number = 1

server/src/schema/mutations/EditCompetition.js

@@ -22,11 +22,11 @@ const args = {
 
 const resolve = (parent, { codeName, displayName, description, startDatetime, finishDatetime,
   formula, plotterCodeName, plotterHost, plotterRepo, plotterModuleName }, context) => {
-  // let authIdOnSession = context.user.sub
   return new Promise((resolve, reject) => {
-    Competition.findOne({ codeName }).exec((err, competition) => {
-      if (err) reject(err)
-      else {
+    Competition.findOne({ codeName, host: context.user.sub }).exec((err, competition) => {
+      if (err || !competition) {
+        reject(err)
+      } else {
         competition.displayName = displayName || competition.displayName
         competition.description = description || competition.description
         competition.startDatetime = startDatetime || competition.startDatetime

server/src/schema/mutations/EditParticipant.js

@@ -14,7 +14,6 @@ const args = {
 }
 
 const resolve = (parent, { competitionCodeName, devTeam, bot, release }, context) => {
-  // let authIdOnSession = context.user.sub
   return new Promise((resolve, reject) => {
     Competition.findOne({ codeName: competitionCodeName }).exec((err, competition) => {
       if (err) reject(err)

server/src/schema/mutations/EditRule.js

@@ -14,11 +14,11 @@ const args = {
 }
 
 const resolve = (parent, { competitionCodeName, title, newtitle, description }, context) => {
-  // let authIdOnSession = context.user.sub
   return new Promise((resolve, reject) => {
-    Competition.findOne({ codeName: competitionCodeName }).exec((err, competition) => {
-      if (err) reject(err)
-      else {
+    Competition.findOne({ codeName: competitionCodeName, host: context.user.sub }).exec((err, competition) => {
+      if (err || !competition) {
+        reject(err)
+      } else {
         let ruleIndex
         competition.rules.find((rule, index) => {
           if (rule.title === title) {

server/src/schema/mutations/HostCompetition.js

@@ -16,10 +16,9 @@ const args = {
 }
 
 const resolve = (parent, { displayName, description, startDatetime, finishDatetime, formula }, context) => {
-  // let authIdOnSession = context.user.sub
-  let authIdOnSession = 'some-id'
+  const host = context.user.sub
   let newCompetition = new Competition({
-    host: authIdOnSession,
+    host,
     displayName,
     description,
     startDatetime,

server/src/schema/mutations/RegisterToCompetition.js

@@ -14,7 +14,6 @@ const args = {
 }
 
 const resolve = (parent, { codeName, devTeam, bot, release }, context) => {
-  // let authIdOnSession = context.user.sub
   return new Promise((resolve, reject) => {
     Competition.findOne({ codeName }).exec((err, competition) => {
       if (err) reject(err)

server/src/schema/mutations/ReorderRules.js

@@ -14,11 +14,11 @@ const args = {
 }
 
 const resolve = (parent, { competitionCodeName, fromNumber, toNumber }, context) => {
-  // let authIdOnSession = context.user.sub
   return new Promise((resolve, reject) => {
-    Competition.findOne({ codeName: competitionCodeName }).exec((err, competition) => {
-      if (err) reject(err)
-      else {
+    Competition.findOne({ codeName: competitionCodeName, host: context.user.sub }).exec((err, competition) => {
+      if (err || !competition) {
+        reject(err)
+      } else {
         const delta = fromNumber > toNumber ? 1 : -1
         competition.rules.forEach((part) => {
           if (part.number === fromNumber) {