Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backend] Problem in delete contact us api Fixed #933

Merged
merged 1 commit into from
May 19, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 17 additions & 46 deletions backend/app/routes/contactUs/delete.js
Original file line number Diff line number Diff line change
@@ -1,55 +1,26 @@
const to = require('await-to-js').default;
const { ErrorHandler } = require('../../../helpers/error');
const constants = require('../../../constants');
const Contact = require("../../models/contactUs");
const Admin = require("../../models/Admin");
const mongoose = require('mongoose');
const ContactUs = require('../../models/contactUs');

// Controller to delete a contact by adminid and contactdocumentid
module.exports = async (req, res, next) => {
const { contactId, adminId } = req.body;
try {
const payload = res.locals.decode;
const { contactUsId } = req.body;

// Check if contactId is provided
if (!contactId || !adminId) {
const error = new ErrorHandler(constants.ERRORS.VALIDATION, {
statusCode: 400,
message: 'Validation Error',
errStack: 'Both IDs are required to delete a contact',
});
return next(error);
if (!payload.isSuperAdmin) {
return res.status(401).json({ error: 'You are not authorized to perform this action' });
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[ques] why are we doing this check? shouldn't auth middleware take care of it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Kajol-Kumari It is the code flow. I followed based on existing code bases.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Kajol-Kumari in every file they is this type of check. So I thought Auth Middleware doesn't handle it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can u provide me the reference of where do u see it, it shouldn't be required ideally, try removing and then test the delete functionality, it should not work without authorization key of an admin

Copy link
Contributor Author

@Hemu21 Hemu21 May 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Kajol-Kumari can you please check this here i saw like this Here

}
//Find if the user is admin or not
const admin = await to(Admin.findOne({ _id: adminId }));
if (!admin) {
const error = new ErrorHandler(constants.ERRORS.USER, {
statusCode: 400,
message: "Admin Validation Error",
errStack: "Admin user provided not found in database"
})
return next(error);
}
// Delete the contact
const [err, result] = await to(Contact.findByIdAndDelete(contactId));

if (err) {
const error = new ErrorHandler(constants.ERRORS.DATABASE, {
statusCode: 500,
message: 'Database Error',
errStack: err,
});
return next(error);
if (!mongoose.Types.ObjectId.isValid(contactUsId)) {
return res.status(400).json({ error: 'Invalid Contact Us ID' });
}

if (!result) {
const error = new ErrorHandler(constants.ERRORS.NOT_FOUND, {
statusCode: 404,
message: 'Contact Not Found',
});
return next(error);
const contactUsEntry = await ContactUs.findByIdAndDelete(contactUsId);
if (!contactUsEntry) {
return res.status(404).json({ error: 'Contact Us entry not found' });
}

res.status(200).send({
message: 'Contact deleted successfully',
});

return next();
};
return res.status(200).json({ message: 'Contact Us entry deleted successfully' });
} catch (error) {
return res.status(500).json({ error: 'Internal server error' });
}
}
8 changes: 4 additions & 4 deletions backend/app/routes/contactUs/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@
const validation = require('../../../helpers/middlewares/validation');
const postContact = require('./post');
const getContact = require('./get');
const deleteContactUs = require("./delete");
const deleteContactUs = require('./delete');
const { authMiddleware } = require('../../../helpers/middlewares/auth');

router.get('/getcontactus', authMiddleware, getContact);
router.post('/contactus', validation(contactValidationSchema), postContact);
router.delete("/deleteContactUs", deleteContactUs);
router.get('/getcontactus', getContact);
router.post('/',authMiddleware, validation(contactValidationSchema), postContact);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.
router.delete("/deleteContactUs",authMiddleware, deleteContactUs);

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
authorization
, but is not rate-limited.

Check failure

Code scanning / CodeQL

Missing rate limiting High

This route handler performs
a database access
, but is not rate-limited.

module.exports = router;
12 changes: 2 additions & 10 deletions backend/app/routes/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,7 @@ const getFaq = require('./faq/getFaq');
const deleteFaq = require('./faq/deleteFaq');
const updateFaq = require('./faq/updateFaq')
const joinUs = require('./joinUs');
const contactUs = require('./contactUs/post');
const deleteContactUs = require("./contactUs/delete");

const getContactUs = require('./contactUs/get');
const contactValidationSchema = require('./contactUs/@validationSchema');
const validation = require('../../helpers/middlewares/validation');

const contactus = require('./contactUs')
const question = require('./Q&A/question');
const answer = require('./Q&A/answers');
const teamMember = require('./teamMember');
Expand All @@ -28,9 +22,7 @@ router.use('/faq', faq);
router.use('/deleteFaq', deleteFaq);
router.use('/updateFaq',updateFaq)
router.use('/getFaq', getFaq);
router.use('/contactus', validation(contactValidationSchema), contactUs);
router.use('/getcontactus', getContactUs);
router.use("/deleteContactUs", deleteContactUs);
router.use('/contactus', contactus);
router.use('/broadcast', broadcast);
router.use('/question', question);
router.use('/answers', answer);
Expand Down
Loading