Minor fixes #38
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -15,6 +15,9 @@ export default function membersRouter( | |
| * @apiGroup Member | ||
| * | ||
| * @apiSuccess {Object[]} unapprovedMembers List of unapproved members. | ||
| * | ||
| * @apiExample {curl} Example usage: | ||
| * curl -X GET http://localhost:3000/members/unapproved | ||
| */ | ||
| router.get("/unapproved", memberCtrl.getUnapprovedMembers); | ||
|
|
||
|
|
@@ -27,6 +30,9 @@ export default function membersRouter( | |
| * | ||
| * @apiSuccess {Object} user Member object. | ||
| * @apiError (Error 400) BadRequest No memberId provided. | ||
| * | ||
| * @apiExample {curl} Example usage: | ||
| * curl -X GET http://localhost:3000/members/123 | ||
| */ | ||
| router.get("/:memberId", memberCtrl.getUserDetails); | ||
|
|
||
|
|
@@ -35,17 +41,23 @@ export default function membersRouter( | |
| * @apiName ListAllApprovedMembers | ||
| * @apiGroup Member | ||
| * | ||
| * @apiDescription | ||
| * - Returns a list of all approved members if no email query parameter is provided. | ||
| * - If `email` query parameter is provided, returns the member associated with that email. | ||
| * | ||
| * @apiQuery {String} [email] Optional email to fetch a specific member. | ||
| * | ||
| * @apiSuccess {Object} user Single user object when email provided. | ||
| * @apiSuccess {Object[]} user Array of approved members when no email provided. | ||
| * @apiSuccess {String} [message] Message in case of full list fetch. | ||
| * | ||
| * @apiError (400) IncorrectEmail The provided email does not match any user. | ||
| * | ||
| * @apiExample {curl} Example usage (list all): | ||
| * curl -X GET http://localhost:3000/members | ||
| * | ||
| * @apiExample {curl} Example usage (get by email): | ||
| * curl -X GET "http://localhost:3000/members?email=john@example.com" | ||
| */ | ||
| router.get("/", memberCtrl.listAllApprovedMembers); | ||
|
|
||
|
|
@@ -54,14 +66,27 @@ export default function membersRouter( | |
| * @apiName CreateAMember | ||
| * @apiGroup Member | ||
| * | ||
| * @apiBody {String} email Email of the member. (Required) | ||
| * @apiBody {String} name Full name of the member. (Required) | ||
| * @apiBody {String} password Member's password. (Required) | ||
| * @apiBody {String} passoutYear Graduation year (Required, e.g., "2026"). | ||
| * @apiBody {String} provider Authentication provider (Required, e.g., "local", "google"). | ||
| * @apiBody {File} [file] Profile photo file (field name: "file"). | ||
| * | ||
| * @apiSuccess {Boolean} success Request status. | ||
| * @apiSuccess {Object} user Created member object. | ||
| * | ||
| * @apiError (Error 400) ApiError Required fields absent. | ||
| * @apiError (Error 500) ServerError Error creating user. | ||
| * | ||
| * @apiExample {curl} Example usage: | ||
| * curl -X POST -F "file=@profile.jpg" \ | ||
| * -F "email=john@example.com" \ | ||
| * -F "name=John Doe" \ | ||
| * -F "password=securePass123" \ | ||
| * -F "passoutYear=2026" \ | ||
| * -F "provider=local" \ | ||
| * http://localhost:3000/members | ||
| */ | ||
| router.post("/", upload.single("file"), memberCtrl.createAMember(supabase)); | ||
|
|
||
|
|
@@ -72,64 +97,87 @@ export default function membersRouter( | |
| * | ||
| * @apiParam {String} memberId Member's unique ID. | ||
| * | ||
| * @apiBody {String} memberData JSON string containing the member's updated details. | ||
| * @apiBody {File} [file] Profile photo file (field name: "file"). | ||
| * | ||
| * @apiBody (memberData fields) {String} [name] Full name of the member. | ||
| * @apiBody (memberData fields) {String} [email] Email address. | ||
| * @apiBody (memberData fields) {String} [phone] Phone number. | ||
| * @apiBody (memberData fields) {String} [bio] Short bio. | ||
| * @apiBody (memberData fields) {String} [github] GitHub handle. | ||
| * @apiBody (memberData fields) {String} [linkedin] LinkedIn handle. | ||
| * @apiBody (memberData fields) {String} [twitter] Twitter handle. | ||
| * @apiBody (memberData fields) {String} [geeksforgeeks] GeeksforGeeks username. | ||
| * @apiBody (memberData fields) {String} [leetcode] LeetCode username. | ||
| * @apiBody (memberData fields) {String} [codechef] CodeChef username. | ||
| * @apiBody (memberData fields) {String} [codeforces] Codeforces username. | ||
| * @apiBody (memberData fields) {Date} [passoutYear] Graduation year (ISO string format). | ||
| * @apiBody (memberData fields) {String} [profilePhoto] (Auto-assigned if a new file is uploaded). | ||
| * | ||
| * @apiSuccess {Boolean} success Request status. | ||
| * @apiSuccess {Object} user Updated member object. | ||
| * | ||
| * @apiError (Error 400) ApiError No memberId provided or invalid request data. | ||
| * @apiError (Error 404) NotFound Member not found. | ||
| * @apiError (Error 500) ServerError Unexpected error occurred during update. | ||
| * | ||
| * @apiExample {curl} Example usage: | ||
| * curl -X PATCH -F "file=@profile.jpg" \ | ||
| * -F 'memberData={"name":"John Doe","email":"john@example.com"}' \ | ||
| * http://localhost:3000/members/123 | ||
| */ | ||
| router.patch( | ||
| "/:memberId", | ||
| upload.single("file"), | ||
| memberCtrl.updateAMember(supabase), | ||
| ); | ||
|
|
||
|
|
||
| /** | ||
| * @api {patch} /members/approve/:memberId Approve a member | ||
| * @apiName UpdateApprovalRequest | ||
| * @apiGroup Member | ||
| * | ||
| * @apiParam (URL Params) {String} memberId Member ID. | ||
| * @apiBody {Boolean} isApproved Approval status (true = approved, false = rejected). | ||
| * @apiBody {String} adminId ID of the admin who approved/rejected. | ||
| * | ||
| * @apiSuccess {Object} update Approval status update result. | ||
| * @apiError (Error 400) BadRequest Missing required fields. | ||
| * | ||
| * @apiExample {curl} Example usage: | ||
| * curl -X PATCH http://localhost:3000/members/approve/123 \ | ||
| * -H "Content-Type: application/json" \ | ||
| * -d '{"isApproved": true, "adminId": "admin123"}' | ||
| */ | ||
| router.patch("/approve/:memberId", memberCtrl.updateRequest); | ||
|
|
||
|
|
||
| /** | ||
| * @api {get} /members/:memberId/achievements Get member's achievements | ||
| * @apiName GetUserAchievements | ||
| * @apiGroup Member | ||
| * | ||
| * @apiParam (URL Params) {String} memberId Member ID. | ||
| * | ||
| * @apiSuccess {Object[]} achievements List of achievements. | ||
| * | ||
| * @apiExample {curl} Example usage: | ||
| * curl -X GET http://localhost:3000/members/123/achievements | ||
| */ | ||
| router.get("/:memberId/achievements", memberCtrl.getUserAchievements); | ||
|
|
||
| /** | ||
| * @api {get} /members/:memberId/projects Get member's projects | ||
| * @apiName GetUserProjects | ||
| * @apiGroup Member | ||
| * | ||
| * @apiParam (URL Params) {String} memberId Member ID. | ||
| * | ||
| * @apiSuccess {Object[]} projects List of projects. | ||
| * | ||
| * @apiExample {curl} Example usage: | ||
| * curl -X GET http://localhost:3000/members/123/projects | ||
| */ | ||
| router.get("/:memberId/projects", memberCtrl.getUserProjects); | ||
|
|
||
|
|
@@ -141,6 +189,9 @@ export default function membersRouter( | |
| * @apiParam (URL Params) {String} memberId Member ID. | ||
| * | ||
| * @apiSuccess {Object[]} interviews List of interviews. | ||
| * | ||
| * @apiExample {curl} Example usage: | ||
| * curl -X GET http://localhost:3000/members/123/interviews | ||
| */ | ||
| router.get("/:memberId/interviews", memberCtrl.getUserInterviews); | ||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -66,33 +66,35 @@ export const createMember = async ( | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| export const updateMember = async ( | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| id: string, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| payload: UpdateMemberPayload | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ) => { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+69
to
70
Contributor
There was a problem hiding this comment. 💡 Verification agent 🧩 Analysis chainConfirm UpdateMemberPayload shape across modules. Ensure 🏁 Script executed: #!/bin/bash
# Inspect UpdateMemberPayload for a 'password' property
rg -n "interface\\s+UpdateMemberPayload" -A 20 src --glob '!node_modules'Length of output: 771 🏁 Script executed: #!/bin/bash
# Show the updateMember method and how it handles the payload
rg -n "updateMember" -C 5 src/services/member.service.tsLength of output: 246 Remove
This guarantees that 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| const { name, ...rest } = payload; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| const dataToUpdate = Object.fromEntries( | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Object.entries({ name, ...rest }).filter(([_, v]) => v !== undefined) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ); | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if (JSON.stringify(dataToUpdate) === "{}") throw new ApiError("No fields passed", 400); | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| return await prisma.member.update({ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| where: { id }, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| data: dataToUpdate, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| }); | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| }; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| export const updatePassword = async(id: string, password: string) => { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| const account = await prisma.account.findFirst({ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| where: { memberId: id }, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| }); | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if (!account) throw new ApiError("Associated account not found", 404); | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| return await prisma.account.update({ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| where: { id: account.id }, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| data: { password }, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| }); | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+85
to
+96
Contributor
There was a problem hiding this comment. 💡 Verification agent 🧩 Analysis chainHash passwords and block password updates for non-credentials accounts.
Apply this diff to enforce provider and hash the password: export const updatePassword = async(id: string, password: string) => {
const account = await prisma.account.findFirst({
where: { memberId: id },
});
if (!account) throw new ApiError("Associated account not found", 404);
- return await prisma.account.update({
+ if (account.provider !== "credentials") {
+ throw new ApiError("Password updates not allowed for OAuth accounts", 400);
+ }
+
+ const hashed = await bcrypt.hash(password, 12);
+ return await prisma.account.update({
where: { id: account.id },
- data: { password },
+ data: { password: hashed },
});
}Add the import (outside this hunk): import bcrypt from "bcryptjs";To ensure no other code paths write plaintext passwords, search for raw 🏁 Script executed: #!/bin/bash
rg -n "password\\s*:\\s*password\\b" --glob '!node_modules' .
rg -n "argon2|bcrypt" --glob '!node_modules' .Length of output: 109 🏁 Script executed: #!/bin/bash
# Find all prisma.account.create/update calls to see where password fields may be set
rg -n 'prisma\.account\.(create|update)' --glob '!node_modules' -A3 .Length of output: 563 🏁 Script executed: #!/bin/bash
# Show full prisma.account.create call to check for password assignments
rg -n 'prisma\.account\.create' --glob '!node_modules' -A10 src/services/member.service.tsLength of output: 346 Enforce password hashing at creation and restrict updates to credentials-only accounts The current implementation stores plaintext passwords on signup and allows password changes for OAuth users. To address both issues: • Add bcrypt import at the top of src/services/member.service.ts Diff for src/services/member.service.ts: --- a/src/services/member.service.ts
+++ b/src/services/member.service.ts
@@
+ import bcrypt from "bcryptjs";
// ...signup or createMember function...
- await prisma.account.create({
- data: {
- provider,
- providerAccountId: email,
- password: provider === "credentials" ? password : null,
- memberId: newMember.id,
- },
- });
+ const hashedPassword = provider === "credentials"
+ ? await bcrypt.hash(password, 12)
+ : null;
+ await prisma.account.create({
+ data: {
+ provider,
+ providerAccountId: email,
+ password: hashedPassword,
+ memberId: newMember.id,
+ },
+ });
// ...later in the file...
export const updatePassword = async (id: string, password: string) => {
const account = await prisma.account.findFirst({
where: { memberId: id },
});
if (!account) throw new ApiError("Associated account not found", 404);
-
- return await prisma.account.update({
- where: { id: account.id },
- data: { password },
- });
+ if (account.provider !== "credentials") {
+ throw new ApiError("Password updates not allowed for OAuth accounts", 400);
+ }
+
+ const newHashed = await bcrypt.hash(password, 12);
+ return await prisma.account.update({
+ where: { id: account.id },
+ data: { password: newHashed },
+ });
};This ensures no plaintext passwords are stored and prevents OAuth accounts from updating passwords. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| export const unapprovedMembers = async () => { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| return await prisma.member.findMany({ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| where: { isApproved: false }, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -15,5 +15,6 @@ declare global { | |
| leetcode?: string; | ||
| codechef?: string; | ||
| codeforces?: string; | ||
| password?: string | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Enhanced validation looks good.
The addition of
providervalidation is consistent with the existing pattern and strengthens the member creation flow.Verify that all API clients and tests include the
providerfield when calling this endpoint:🏁 Script executed:
Length of output: 6644
Tests and API docs must be updated for the new
providervalidationThe added
provider—and previously existingpassoutYear—fields now break thecreateAMembertests and out-of-date JSDoc. Please:• tests/Member.test.ts
– Include both
passoutYearandproviderin thereq.bodyfixtures for your createAMember tests.– Example diff:
it('should respond with 201 and created member', async () => { - const req = { - body: { - email: 'shruti@example.com', - name: 'Shruti', - password: 'password123', - } - } as Request; + const req = { + body: { + email: 'shruti@example.com', + name: 'Shruti', + password: 'password123', + passoutYear: 2025, + provider: 'local', + } + } as Request;• src/routes/members.ts
– Update your route JSDoc to surface the new parameters:
* @apiBody {String} [name] Full name of the member. + * @apiBody {Number} passoutYear Graduation year of the member. + * @apiBody {String} provider Authentication provider for the member. * @apiBody {File} [file] Profile photo file (field name: "file").Once tests and docs are aligned with the controller’s required fields, the build will pass and the validation enhancement remains effective.
📝 Committable suggestion
🤖 Prompt for AI Agents
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@shrutiiiyet
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.