During the third and final Sprint of this semester, me and my partner Hiercine basically did exactly what we did during the last Sprint. We continued to work on modifying the endpoints within the guestinfosystem backend in order to accept access tokens that will let the system know if the request comes from someone who is authorized to make that request. Since we worked on the same task and just made some more progress, I’ll explain the code that we came up with.
The main issue that Hiercine and I had during this Sprint was having to depend on another team. On the last day of class, we checked in with the professor and the other team still hadn’t finished their code so we weren’t able to proceed. We had to leave our code as a merge request draft for someone else to work on in a future semester, leaving a blank spot for the other team’s code to get inserted.
While we did have a major issue that prevented us from being able to fully complete our work, I think Hiercine and I did a great job finishing what we could. We made sure to communicate the situation with each other, the rest of our team, and the professor. We also made sure to research more into keycloak to figure out how to use it since that’s what the other group was using. As a team, I think we did a great job and don’t think that there is much we could have improved upon.
A pattern from the Apprenticeship Patterns book that is relevant to my experience during this Spring is the “Use the Source” pattern. This pattern focuses on the importance of digging into the actual source code when you’re trying to understand how something works instead of relying on secondhand documentation, assumptions, or waiting for explanations. I selected this pattern because of how Hiercine and I looked at the group’s code and did our own research on keycloak instead of asking the other team to explain it to us, since that didn’t go well last time. The “Use the Source” pattern encourages this behavior, allowing you to understand it yourself.
Here is the checkAuthorization endpoint we created (with line numbers):
- /*const axios = require(‘axios’);
- async function checkAuthorization(request, requiredRole) {
- try {
- //Assuming the user’s role is stored in a token (e•g-, JWT in headers)
- const userToken = request. headers.authorization;
- if (!userToken) {
- return false; // No token, unauthorized
- }
- // Make a request to the authentication service to verify the role
- const authResponse = await axios.get (“https://your-aut api.com/verifyRole”, {
- headers: { Authorization: userToken }
- });
- const userRole = authResponse.data.role; // Assuming the API returns { role: “pantrystaff” )
- return userRole == “PantryStaff” || userRole == “PantryAdmin”|| userRole == “SpecificUser”; //SpecificUser == UUID
- }
- catch (error) {
- console.error (“Authorization check failed:”, error);
- return false;}
- }
- module. exports = checkAuthorization;*/
Here is an explanation of what each section of the code does:
Line 1: Imports the Axios Library for HTTP requests.
Lines 3-6: Starts a try block to handle errors while extracting the Authorization token from the request headers.
Lines 8-10: Check to see if the token is missing, returns false to deny access if there isn’t one.
Lines 13-16: Sends a GET request to the external authorization service using the token in the header to validate the user. This is what the other group would provide.
Lines 18-20: Extracts the user’s role from the response and checks if it matches one of the roles.
Lines 22-26: Logs any errors and returns false, as well as an export statement to make the function reusable in other files.
Here is a link to the merge request draft: https://gitlab.com/LibreFoodPantry/client-solutions/theas-pantry/guestinfosystem/guestinfobackend/-/merge_requests/118
From the blog CS@Worcester – One pixel at a time by gizmo10203 and used with permission of the author. All other rights reserved by the author.
