Added security check for authorized token in cleezy.js helper function

Author: Pikalot

api/main_endpoints/routes/Cleezy.js

@@ -4,6 +4,7 @@ const router = express.Router();
 const {
   decodeToken,
   checkIfTokenSent,
+  checkIfTokenValid,
 } = require('../util/token-functions.js');
 const {
   OK,
@@ -13,6 +14,7 @@ const {
 } = require('../../util/constants').STATUS_CODES;
 const logger = require('../../util/logger');
 const { Cleezy } = require('../../config/config.json');
+const membershipState = require('../../util/constants').MEMBERSHIP_STATE;
 const { ENABLED } = Cleezy;
 
 let CLEEZY_URL = process.env.CLEEZY_URL
@@ -97,14 +99,19 @@ router.post('/deleteUrl', async (req, res) => {
     });
 });
 
+const searchCleezyUrls = async (req) => {
+  if(!ENABLED || !req.body.query) {
+    return { status: OK, data: [] };
+  }
 
-const searchCleezyUrls = async (query) => {
-  if(!ENABLED || !query) {
-    return;
+  if (!checkIfTokenSent(req)) {
+    return { status: FORBIDDEN, data: [] };
+  } else if (!checkIfTokenValid(req, membershipState.OFFICER)) {
+    return { status: UNAUTHORIZED, data: [] };
   }
 
   try {
-    const cleezyQuery = query.replace(/[^a-zA-Z0-9]/g, '');
+    const cleezyQuery = req.body.query.replace(/[^a-zA-Z0-9]/g, '');
     const cleezyRes = await axios.get(CLEEZY_URL + '/list', {
       params: {
         search: cleezyQuery
@@ -117,9 +124,10 @@ const searchCleezyUrls = async (query) => {
         return { ...e, link: u.href };
       });
 
-    return cleezyData;
+    return { status: OK, data: cleezyData };
   } catch (err) {
     logger.error('cleezy search urls had an error', err);
+    return { status: SERVER_ERROR, data: [] };
   }
 };
 

api/main_endpoints/routes/ShortcutSearch.js

@@ -117,9 +117,24 @@ router.post('/', async function(req, res) {
       });
     }
 
-    const cleezyData = await cleezy.searchCleezyUrls(req.body.query);
+    const cleezyRes = await cleezy.searchCleezyUrls(req); // .body.query, req);
+    if (cleezyRes.status !== OK) {
+      logger.warn('Cleezy search failed', {
+        status: cleezyRes.status
+      });
+
+      return res.status(OK).send({
+        cleezyStatus: cleezyRes.status,
+        items: { users }
+      });
+    }
 
-    res.status(OK).send({ items: {users, cleezyData} });
+    return res.status(OK).send({
+      items: {
+        users,
+        cleezyData: cleezyRes.data,
+      }
+    });
   } catch (error) {
     logger.error('/shortcutsearch encountered an error:', { error, query: req.body.query });
     if (error.response && error.response.data) {