Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
import { Controller, Post, HttpStatus, HttpCode, Get, Body } from '@nestjs/common';
import { AuthService } from './auth.service';
import { ValidationPipe } from '../common/pipes/validation.pipe';
import { CommonResult } from '../models/common-result';
@Controller('api/auth/')
export class AuthController {
constructor(private readonly authService: AuthService) {
}
@HttpCode(HttpStatus.OK)
@Post('login')
public async getToken( @Body(new ValidationPipe()) user) {
try {
return await this.authService.getAccessToken(user);
} catch (err) {
return new CommonResult(false, 'Server error');
}
}
@Get('authorized')
public async authorized() {
console.log('Authorized route...');
}
}
{
id
},
req.user
)
);
} catch (error) {
throw error;
}
}
@Roles('isSuperuser')
@Permissions('read_status')
@HttpCode(HttpStatus.OK)
@ApiResponse({
status: HttpStatus.OK,
type: OutStatusDto,
description: ''
})
@ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Forbidden.' })
@ApiImplicitParam({ name: 'id', type: Number })
@Get(':id')
async load(@Req() req, @Param('id', new ParseIntPipe()) id) {
try {
return plainToClass(
OutStatusDto,
await this.service.findById(
{
id
},
req.user
)
if (updated) {
const { id, ...result } = updated;
return result as TodoDTO;
} else {
throw new HttpException(
'An internal error has occurred and the object has not been updated',
HttpStatus.INTERNAL_SERVER_ERROR,
);
}
} catch (error) {
throw error;
}
}
@Delete(':id')
@ApiResponse({ status: HttpStatus.OK, type: TodoDTO })
@ApiResponse({ status: HttpStatus.BAD_REQUEST, type: ApiException })
@ApiOperation(getOperationId('Todo', 'Delete'))
async delete(@Param('id') identifier: number): Promise {
try {
const exists = await this._todoService.findById(identifier);
if (!exists) {
throw new HttpException(
'No element found with this id',
HttpStatus.BAD_REQUEST,
);
}
const deleted = await this._todoService.deleteById(identifier);
if (deleted) {
const { id, ...result } = deleted;
return result as TodoDTO;
} else {
return plainToClass(
OutUserDto,
await this.service.create({
item: await plainToClass(User, dto).setPassword(dto.password),
}),
);
} catch (error) {
throw error;
}
}
@Roles('isSuperuser')
@Permissions('change_user')
@HttpCode(HttpStatus.OK)
@ApiResponse({
status: HttpStatus.OK,
type: OutUserDto,
description: 'The record has been successfully updated.',
})
@ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Forbidden.' })
@ApiImplicitParam({ name: 'id', type: Number })
@Put(':id')
async update(@Param('id', new ParseIntPipe()) id, @Body() dto: InUserDto) {
try {
return plainToClass(
OutUserDto,
await this.service.update({
id,
item: await plainToClass(User, dto).setPassword(dto.password),
}),
);
} catch (error) {
return plainToClass(
OutUserDto,
await this.service.create({
item: await plainToClass(User, dto).setPassword(dto.password)
})
);
} catch (error) {
throw error;
}
}
@Roles('isSuperuser')
@Permissions('change_user')
@HttpCode(HttpStatus.OK)
@ApiResponse({
status: HttpStatus.OK,
type: OutUserDto,
description: 'The record has been successfully updated.'
})
@ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Forbidden.' })
@ApiImplicitParam({ name: 'id', type: Number })
@Put(':id')
async update(@Param('id', new ParseIntPipe()) id, @Body() dto: InUserDto) {
if (this.coreConfig.demo) {
throw new MethodNotAllowedException('Not allowed in DEMO mode');
}
try {
return plainToClass(
OutUserDto,
await this.service.update({
id,
item: await plainToClass(User, dto).setPassword(dto.password)
Body
} from '@nestjs/common';
import { UserService } from '../user/user.service';
import { LoginRequest } from './requests/login.request';
import { ApiImplicitBody, ApiUseTags } from '@nestjs/swagger';
@Controller()
@ApiUseTags('authentication')
export class AuthenticationController {
constructor(
private readonly authenticationService: AuthenticationService,
private readonly userService: UserService
) {}
@Post('login')
@HttpCode(HttpStatus.OK)
public async login(@Body() body: LoginRequest, @Res() res): Promise {
if (!body.email || !body.password) {
return res
.status(HttpStatus.BAD_REQUEST)
.send('Missing email or password.');
}
const user = await this.userService.findOne({
where: {
email: body.email,
password: crypto
.createHmac('sha256', body.password)
.digest('hex')
}
});
if (!user) {
@ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Forbidden.' })
@Post()
async create(
@Body() dto: InContentTypeDto
) {
try {
let object = plainToClass(ContentType, dto);
object = await this.contentTypeRepository.save(object)
return plainToClass(OutContentTypeDto, object);
} catch (error) {
throw error;
}
}
@Roles('isSuperuser')
@Permissions('change_content-type')
@HttpCode(HttpStatus.OK)
@ApiResponse({
status: HttpStatus.OK, type: OutContentTypeDto,
description: 'The record has been successfully updated.'
})
@ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Forbidden.' })
@ApiImplicitParam({ name: 'id', type: Number })
@Put(':id')
async update(
@Param('id', new ParseIntPipe()) id,
@Body() dto: InContentTypeDto
) {
try {
let object = plainToClass(ContentType, dto);
object.id = id;
object = await this.contentTypeRepository.save(object);
return plainToClass(OutContentTypeDto, object);
@Post()
async create(@Body() dto: InGroupDto) {
try {
return plainToClass(
OutGroupDto,
await this.service.create({
item: plainToClass(Group, dto)
})
);
} catch (error) {
throw error;
}
}
@Roles('isSuperuser')
@Permissions('change_group')
@HttpCode(HttpStatus.OK)
@ApiResponse({
status: HttpStatus.OK,
type: OutGroupDto,
description: 'The record has been successfully updated.'
})
@ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Forbidden.' })
@ApiImplicitParam({ name: 'id', type: Number })
@Put(':id')
async update(@Param('id', new ParseIntPipe()) id, @Body() dto: InGroupDto) {
try {
return plainToClass(
OutGroupDto,
await this.service.update({
id,
item: plainToClass(Group, dto)
})
async register(@Request() req: UserRequest) {
try {
return await this.bookingService.createBooking(
req.body.booking,
req.body.invitedGuests,
req.user,
);
} catch (e) {
return new BadRequestException(e.message, e);
}
}
@UseGuards(AuthGuard(), RolesGuard)
@Roles('waiter')
@Post('booking/search')
@ApiResponse({ status: HttpStatus.OK })
@ApiResponse({ status: HttpStatus.BAD_REQUEST, type: BadRequestException })
@HttpCode(200)
async searchBooking(@Body() search: BookingSearch): Promise {
try {
const [bookings, totalElements]: [
Booking[],
number
] = await this.bookingService.searchBooking(search);
return BookingPage.fromBookings(totalElements, search.pageable, bookings);
} catch (error) {
throw new BadRequestException(error.message, error);
}
}
@Get('invitedguest/accept/:token')
@HttpCode(204)
try {
return plainToClass(
OutContentTypeDto,
await this.service.delete({
id
})
);
} catch (error) {
throw error;
}
}
@Roles('isSuperuser')
@Permissions('read_content-type')
@HttpCode(HttpStatus.OK)
@ApiResponse({
status: HttpStatus.OK,
type: OutContentTypeDto,
description: ''
})
@ApiResponse({ status: HttpStatus.FORBIDDEN, description: 'Forbidden.' })
@ApiImplicitParam({ name: 'id', type: Number })
@Get(':id')
async findById(@Param('id', new ParseIntPipe()) id) {
try {
return plainToClass(
OutContentTypeDto,
await this.service.findById({
id
})
);
} catch (error) {
throw error;