Forem: Osinachi Chukwujama

Automating User Management and Permissions on Linux using Bash Scripting

Osinachi Chukwujama — Tue, 02 Jul 2024 06:04:17 +0000

Linux is a multi-user operating system and as such, an administrator can create users and groups for different purposes. Both users and groups have their permissions. When a user is added to a group, it inherits the permissions of that groups. In this article, you will learn how to work with permissions for users and groups by creating different users and adding them to different groups. The process will be automated using a bash script.

Requirements

Users and their groups are defined in a text file that will be supplied to the script as an argument
A corresponding home directory will be created for each user
User passwords should be stored securely in a file with path /car/secure/user_passwords.txt
Logs of all actions should be logged to /var/log/user_management.log
Only the owner, in this case root, should be able to access the user_password.txt file
Errors should be gracefully handled

Creating users

To create a user, you can use the useradd command. This command can be set to create a user, create their home directory, and set their password. If you simply wish to add a user to the linux system, you can run:

sudo useradd <username>

<username> here is the name of the user you wish to add. However, if you wish to create a home directory and add a password, you can run this instead:

sudo useradd -m -p $(openssl passwd -6 "$password") <username>

This command uses the -m flag to add a home directory and the -p flag to add a password (encrypted using openssl) for the user.

Adding users to groups

By default, when a user is created, a personal group with their username is also created. This means you won't need to explicitly create this. However, to add a user to group, say sudo, you must use the usermod command. Find the basic command structure below:

sudo usermod -aG "<group>" "<user>"

The -a flag is used to append the user to the new group without removing them from existing groups. The -G flag on the other hand specifies the group that the user will be added to, in this case, .

Creating groups

When a group doesn't exist, it should be created before a user is added to it. Groups are typically created using the groupadd command. Here's an example of the command in action:

sudo groupadd "<group>"

Combining user creation, group creation, and group addition

You can command user creation, group creation, and adding a user to a group in a script. Say you have your users and groups defined in a semi-colon delimited script like this:

user1; group1, group2
user2; group3,group6
user3;group2,group3

You can write a script that loops through the file, extracts the relevant information, and creates the users and groups.

USERS_FILE=$1

mapfile -t lines < "$USERS_FILE"

# loop over each line in the array
for line in "${lines[@]}"; do
    # Remove leading and trailing whitespaces
    line=$(echo "$line" | xargs)

    # Split line by ';' and store the second part
    IFS=';' read -r user groups <<< "$line"

    # Remove leading and trailing whitespaces from the second part
    groups=$(echo "$groups" | xargs)

    # Create a variable groupsArray that is an array from spliting the groups of each user
    IFS=',' read -ra groupsArray <<< "$groups"

    # Generate a 6-character password using pwgen
    password=$(pwgen -sBv1 6 1)

    # Create the user with the generated password
    sudo useradd -m -p $(openssl passwd -6 "$password") "$user"

    # loop over each group in the groups array
    for group in "${groupsArray[@]}"; do
        group=$(echo "$group" | xargs)

        # Check if group exists, if not, create it
        if ! grep -q "^$group:" /etc/group; then
            sudo groupadd "$group"
            echo "Created group $group"
        fi

        # Add user to the group
        sudo usermod -aG "$group" "$user"
        echo "Added $user to $group"
    done

    echo "User $user created and added to appropriate groups"
done

Now, the script above does the following:

It takes in a single argument, expressed using $1. It then sets this argument as the variable, $USERS_FILE.
It uses the mapfile command to load the content of the $USERS_FILE into an array called lines.
It loops through each lines of lines and extracts the user and groups using the Internal Field Separator (IFS) shell command.
It generates a 6-character password using pwgen. pwgen is linux package that allows you to create passwords to your exact specification.
It loops over the groups, after splitting each group into groups using IFS, creates the group if it doesn't exist, and adds the user to the group.

Securing the script: Hashing passwords with openssl

While the script above performs all the operations needed to create users and groups, and then add the users to groups, it does not consider security. The major security issue is that the generated passwords are added to users in plaintext format. To solve this problem, you can utilize openssl to hash the password. You can simply run openssl passwd -6 (generated_password) to achieve hashing. This command uses the SHA 512 algorithm for hashing. It's security is comparable to SHA 256 which is the most prominent hashing algorithm on the internet.

Encrypting and storing the passwords

Since this script creates users, it is wise to capture the generated passwords in a file. But to do that securely, the passwords must be encrypted. Password encryption can also be done using openssl. But it'll require and encryption key. You can use the command below to generate, encrypt, and store a password.

    # Generate a 6-character password using pwgen
    password=$(pwgen -sBv1 6 1)

    # Encrypt the password before storing it
    encrypted_password=$(encrypt_password "$password" "$PASSWORD_ENCRYPTION_KEY")

    # Store the encrypted password in the file
    echo "$user:$encrypted_password" >> "$PASSWORD_FILE"

The $PASSWORD_ENCRYPTION_KEY and $PASSWORD_FILE must be defined for this operation to complete successfully.

A look at the secure script

Here's the updated script with the password encryption and password hashing functionalities:

#!/bin/bash

PASSWORD_FILE_DIRECTORY="/var/secure"
PASSWORD_FILE="/var/secure/user_passwords.txt"
PASSWORD_ENCRYPTION_KEY="secure-all-things"
USERS_FILE=$1

# Function to encrypt password
encrypt_password() {
    echo "$1" | openssl enc -aes-256-cbc -pbkdf2 -base64 -pass pass:"$2"
}

# Create the directory where the user's password file will be stored
sudo mkdir -p "$PASSWORD_FILE_DIRECTORY"
sudo touch "$PASSWORD_FILE"
sudo chmod 600 "$PASSWORD_FILE" # Set read permission for only the owner of the file
sudo chown root:root "$PASSWORD_FILE" # Set the owner as the root user

# load the content of the users.txt file into an array: lines
mapfile -t lines < "$USERS_FILE"

# loop over each line in the array
for line in "${lines[@]}"; do
    # Remove leading and trailing whitespaces
    line=$(echo "$line" | xargs)

    # Split line by ';' and store the second part
    IFS=';' read -r user groups <<< "$line"

    # Remove leading and trailing whitespaces from the second part
    groups=$(echo "$groups" | xargs)

    # Create a variable groupsArray that is an array from spliting the groups of each user
    IFS=',' read -ra groupsArray <<< "$groups"


    # Generate a 6-character password using pwgen
    password=$(pwgen -sBv1 6 1)

    # Encrypt the password before storing it
    encrypted_password=$(encrypt_password "$password" "$PASSWORD_ENCRYPTION_KEY")

    # Store the encrypted password in the file
    echo "$user:$encrypted_password" >> "$PASSWORD_FILE"

    # Create the user with the generated password
    sudo useradd -m -p $(openssl passwd -6 "$password") "$user"

    # loop over each group in the groups array
    for group in "${groupsArray[@]}"; do
        group=$(echo "$group" | xargs)

        # Check if group exists, if not, create it
        if ! grep -q "^$group:" /etc/group; then
            sudo groupadd "$group"
            echo "Created group $group"
        fi

        # Add user to the group
        sudo usermod -aG "$group" "$user"
        echo "Added $user to $group"
    done

    echo "User $user created and password stored securely"
done

# remove the created password from the current shell session
unset password

The script above includes the additional functionality as preventing non-root users from accessing the password storage file and also removing the password variable using unset password from the shell where it is run.

Adding logging to the script

The script can be further improved by logging the commands to a log file. This file can be defined as a variable at the top of the script then a redirection command can be added to redirect logs from the script to the log file. We can also direct errors that might occur to the std out, that's the normal output you see when you run commands without errors. Both log types will ultimately be sent to the log file. The command below illustrates this:

# Redirect stdout and stderr to log file
exec > >(tee -a "$LOG_FILE") 2>&1 
echo "Executing script... (note that this line will be logged twice)" | tee -a $LOG_FILE

The echo "Executing script..." command is added so that the normal console shows the logs too. It's not wise to run a script without seeing an output. The addition of this line will ultimately mean it gets shown in the log file twice, but this is the compromise that has to be made.

Adding Error Handling

Errors can be handled and prevented using exception handling. We can add functions that check that both openssl and pwgen are installed, otherwise installs them. When can also add handlers that check if arguments are not passed to the script and if the argument passed for the user's file is a valid file. Here's a snippet with these exception handlers:

#!/bin/bash

LOG_FILE="/var/log/user_management.log"
PASSWORD_FILE_DIRECTORY="/var/secure"
PASSWORD_FILE="/var/secure/user_passwords.txt"
PASSWORD_ENCRYPTION_KEY="secure-all-things"
USERS_FILE=$1

# Function to display usage information
usage() {
    echo "Usage: $0 <user-data-file-path>"
    echo "    <user-data-file-path>: Path to the file containing user data."
    echo
    echo "The user data file should contain lines in the following format:"
    echo "    username;group1,group2,..."
    echo
    echo "Example:"
    echo "    light; dev,sudo"
    echo "    mayowa; www-data, admin"
    exit 1
}

# Check if script is run with sudo
if [ "$(id -u)" != "0" ]; then
    echo "This script must be run with sudo. Exiting..."
    exit 1
fi


# Check if an argument was provided
if [ $# -eq 0 ]; then
    echo "Error: No file path provided."
    usage
fi

# Check if the user's data file exists
if [ ! -e "$USERS_FILE" ]; then
    echo "Error: The provided user's data file does not exist: $USERS_FILE"
    usage
fi

# Function to check if a package is installed
is_package_installed() {
    dpkg -s "$1" >/dev/null 2>&1
}

# Check if openssl is installed
if ! is_package_installed openssl; then
    echo "openssl is not installed. Installing..."
    sudo apt-get update
    sudo apt-get install -y openssl
fi

# Check if pwgen is installed
if ! is_package_installed pwgen; then
    echo "pwgen is not installed. Installing..."
    sudo apt-get update
    sudo apt-get install -y pwgen
fi

# Check if the file exists
if [ ! -f "$USERS_FILE" ]; then
    echo "Error: $USERS_FILE not found."
    exit 1
fi

An exception is also added that checks if the script was run using the sudo command. This is because sudo is required to perform useradd and groupadd operations.

Conclusion

This article outlines the process of creating users and groups in an automated manner using a script. It makes various assumptions and trade-offs to ensure that the script is secure while being usable. Now as an administrator, you can use this script to automate user additions for your organization.

You can find the full script in this Github repo. Shoutout to HNG for this opportunity to learn non-trivial bash scripting using a real-world example. You can join an upcoming HNG internship by regularly checking their internship page. You can also hire elite talent for your project from the HNG network by visiting HNG hire

wget tips

Osinachi Chukwujama — Sun, 16 Jul 2023 08:21:01 +0000

Save a file with an extension and desired filename

wget -A png -O filename.png https://download.url/file.png

Downloadable image

docker login azure fails

Osinachi Chukwujama — Thu, 14 Jan 2021 07:11:37 +0000

docker login azure fails

Jan 14 '21 Comments: 6 Answers: 0

I'm trying to use Azure Container Instances (ACI) with docker. I'm meant to log in at first. I tried using this command

docker login azure

After putting in my username and password

Username: chukwujama.osinachi@studentambassadors.com
Password

I get this error

Error response from daemon: Get https://azure/v2/: dial tcp: lookup azure: Temporary

…

Open Full Question

How I Built the Best Tic-Tac-Toe Game Ever

Osinachi Chukwujama — Sat, 09 Jan 2021 21:36:06 +0000

What I built

Multiplayer tic-tac-toe using AdonisJS, Websockets and Redis.

Category Submission:

Since this is a fun game, it fits into the Random Roulette category.

App Link

https://tic-tac-toe-trm58.ondigitalocean.app/

Screenshots

Description

A multiplayer Tic-Tac-Toe which uses Redis for storing game state during play. It uses web socket technology to enable real-time communication

Link to Source Code

https://github.com/vicradon/tic-tac-toe

Permissive License

The source code is licenced under the MIT Licence.

Background

Photo by Igor Karimov on Unsplash

I wanted to improve my Node.js skills by building something cool. I thought to myself, what's cooler than games? Nothing is cooler than games. So I started building the game.

How I built it

I mostly wrote down my tasks on each day of development in the README. When I completed those tasks, I commit and push to Github.

How to deploy an AdonisJS app and Redis to Digital Ocean

Osinachi Chukwujama — Sat, 09 Jan 2021 21:24:09 +0000

Introduction

The Digital Ocean App Platform simplifies deployment to four steps.

Choose repo
Set app name and region
Set environment variables
Choose plan

In this blog, we will learn how to deploy an AdonisJS app which requires Redis to Digital Ocean.

Getting started

If you don't have a repo already, fork and clone this one

$ gh repo fork https://github.com/vicradon/tic-tac-toe.git

You can do it manually if you don't have the Github CLI.

After cloning, install the adonis CLI globally (use sudo for Linux)

$ npm i -g @adonis/cli

Afterwards, create a .env file

$ cp .env.example .env

Finally, generate an app key

$ adonis key:generate

This key will be copied to the .env file. Take note of it. We will make use of it later.

Deploying a Redis Cluster

Since our app needs Redis, we have to deploy Redis separately.

Step 1: Navigating to the databases page

Navigate to the new database page to create a Redis Cluster

Step 2: Choose a Datacenter

Choose a datacenter closest to most of your users.

Step 3: Choose a Database Cluster Name

You can either leave it as the default or choose a new name. Click the Create a Database Cluster button to continue.

While Digital Ocean provisions our Redis Cluster, we will deploy our Adonis App.

Deploying the Adonis App

Step 1: Choose Your Repo

Step 2: Choose an App Name, Region and Branch

As we previously did, choose an app name and region closest to you. You can also select your branch from here.

Step 3: Configure Your App

Digital Ocean is able to smartly detect what our app runs on.

We need to set a few environment variables.

To obtain the values of REDIS_HOST, REDIS_PORT and REDIS_PASSWORD, go to the database cluster you deployed earlier and skip the getting started page shown.

In the connection details section, you should be able to see the host, port and password.

Copy the values of each and set them as environment variables in your app's deployment page

App Key and Redis Connection

Obtain the APP_KEY value from the project's environment file. Ensure you set REDIS_CONNECTION as prod. You should have 5 environment variables in total.

Setting the run command

Set the run command as npm run prod. This will run the app with a disabled .env file.

Step 4: Setting the app's plan

Select the basic plan and click the Launch Basic App button.

Your app should be deployed within a few minutes. Here's my own deployed app.

A note about TLS

Redis clusters on Digital Ocean have SSL enabled. This means you won't be able to connect to it using the redis-cli without configuring stunnel. Alternatively, you can use redli to connect to a Redis cluster over SSL.

Adonis uses ioredis as its default redis client. ioredis requires a tls host in its config to connect to a cluster over SSL. If you check config/redis.js file in the app, you'll see the tls object in the prod variables.

  prod: {
    host: Env.get("REDIS_HOST"),
    port: Env.get("REDIS_PORT"),
    password: Env.get("REDIS_PASSWORD"),
    db: 0,
    keyPrefix: "",
    tls: {
      host: Env.get("REDIS_HOST"),
    },
  },

Conclusion

In this tutorial, you learned how to deploy an AdonisJS app and a Redis cluster to Digital Ocean. You experienced the ease of deployment Digital Ocean offers for app developers. You also learned more about Transport Layer Security on Redis clusters.

If you enjoyed this tutorial, you can subscribe to my newsletter on my website and also follow me on Twitter. Thanks for reading. Adios ✌🏾🧡.

Building a Multiplayer TicTacToe Game

Osinachi Chukwujama — Sat, 09 Jan 2021 17:30:22 +0000

Building real-time multiplayer games on the web require open channel communication using TCP or UDP. Websockets can be used to achieve real-time communication. A WebSocket is a TCP communication protocol that allows for two-way communication between a server and a client. When comparing WebSockets to HTTP, you'll learn that servers can communicate with clients without a request (trigger) from the client.

How the game is structured

The game follows the simple logic of

Generate game code
Share with a different player
Play in multiple rounds You can see the live version here.

https://tic-tac-toe-trm58.ondigitalocean.app/

Deploying To Digital Ocean

Digital Ocean simplifies the deployment of applications through the app platform. They implemented a mechanism such that the type of app is detected an analysed. The deployment requirements are obtained and fixed in the deployment process.

So when I was deploying this app, Digital Ocean affixed ENV_SILENT to the start command. I haven't seen any other cloud provider with such precision.

ENV_SILENT=true npm start

What I learned about deployment

Digital Ocean will fail to deploy a Node.js app without a package-lock.json. Funny right? I wonder why the lock file is ignored in the .gitignore of some projects.

Also, if tls host is excluded from ioredis' config, it will fail to connect to a Redis server secured by SSL.

  prod: {
    host: Env.get("REDIS_HOST"),
    port: Env.get("REDIS_PORT"),
    password: Env.get("REDIS_PASSWORD"),
    db: 0,
    keyPrefix: "",
+   tls: {
+     host: Env.get("REDIS_HOST"),
+   },
  },

In the next post of the series, we'll look into a step-step process of deploying the game on Digital Ocean.

Learn Laravel as a Nodejs Developer using AdonisJS

Osinachi Chukwujama — Mon, 07 Dec 2020 14:19:47 +0000

If you have been willing to develop Laravel applications as a Nodejs developer and don't know PHP, you can take the Adonis.js path. Adonis.js is an opinionated Node.js MVC framework for developing full-stack applications and APIs. Learning Adonis will give the chance to learn some concepts like migrations and working with a CLI. The best part is that you still develop using JavaScript!

As you may know, Laravel is a PHP framework that offers a lot of goodies out of the box. At the core, Laravel and Adonis share the same philosophy.

Similarities between Laravel and Adonis

They have a similar MVC structure.
They come with an Object Relational Mapper (ORM). Laravel comes with Eloquent while Adonis comes with Lucid
They handle session-based auth out of the box. Adonis goes two steps forward by handling JWT and personal token auth.

Differences

Laravel is more opinionated than Adonis. In fact, Laravel 7 comes out of the box with Bootstrap as the default CSS library.
Laravel is more mature than Adonis. Laravel has been around since 2011 while adonis has been in active development since 2017.

So how do I learn Adonis.js?

The official documentation is by far the best way to learn the bits and pieces of Adonis.js. But if you will like someone to hold your hand while you learn, you can check this awesome AdonisJS series (shameless plug) on building a real-world API using AdonisJS.

DesignCourse has a crash course on adonis.js
Adonis Mastery YouTube channel has a full series on Adonis.

So after learning Adonis, how do I learn Laravel?

After learning Adonis, you will have a good overview of the core concepts behind Laravel and might not need a tutorial. If you do need a tutorial, you will find tons of amazing tutorials on laracasts.io.

Benefits of developing with Laravel

Out of the box configuration for authentication, Redis, 2FA, Mail and much more.
Ability to build Single Page Apps (SPAs) without a different server setup. Think of it as a modern monolith approach. This is achieved either through Livewire or Inertia.
Automatic frontend asset compilation with Mix.
Vibrant community so you never get lost.

Check out both frameworks, learn the pros of each and save yourself set up hassle. Do leave a star on the Laravel github page and also one for Adonis. Thanks for reading. Adios ✌🏾🧡.

Algorithmic walkthrough: Merging 2 Packages

Osinachi Chukwujama — Sun, 06 Dec 2020 19:32:12 +0000

So, let's say we have an algo problem with the following statement

Given a package with a weight limit limit and an array arr of item weights, implement a function getIndicesOfItemWeights that finds two items whose sum of weights equals the weight limit limit. Your function should return a pair [i, j] of the indices of the item weights, ordered such that i > j. If such a pair doesn’t exist, return an empty array.

Problem Analysis

Before writing any code in an interview or an algorithmic problem try to explain it in plain English or pseudocode.

Parameters

limit
arr

Requirements

Finding two items in arr whose sum is limit
Returning the indices of these items
The bigger index should be the first in the returned array.

The basic idea is finding a pair that adds up to the limit limit. The first solution you may think of is having a nested for-loop where we try to find a pair that sums up to limit.

Naive Solution

Notice how we used

for index in range(numIndex+1, len(arr)):

in the second for-loop? We don't want to compute the same pair twice, so we set the second loop to be an index ahead of the first. So for an array: [2, 4, 1, 5], we have the following pairs

2, 4
2, 1
2, 5
4, 1
4, 5
1, 5

Time complexity

The implementation above has a time complexity of O(n^2) (quadratic) because of the for-loop. In the worst case, we will have to compute the last pair before returning an answer.

Conclusion

You have learned a use case of hashmaps and how to move from a nested for-loop to a cleaner solution using a hashmap. The hashmap uses more space but offers faster implementation. Thanks for reading. Adios ✌🏾🧡.

CGPA Calculator with AdonisJS: API Testing

Osinachi Chukwujama — Sat, 05 Dec 2020 20:33:17 +0000

Testing is an important part of any software development project. Testing gives us confidence in our code and helps us catch bugs before deployment. Welcome to part 5 of this series. We wrote the final APIs in part 4. Now, we will write functional tests for our APIs. If you will like to skip the previous steps, clone the repo and checkout to the more-relationships-and-seeding branch, then code along.

Functional Testing

According to Wikipedia

Functional testing is a quality assurance (QA) process and a type of black-box testing that bases its test cases on the specifications of the software component under test.

Basically, functional tests are written in a way that matches how a real user will interact with the app. Take, for example, we want to test course addition from scratch. We will

Open a headless or real browser
Navigate to the register page
Register the user
Navigate to the course addition form
Fill in the details
Sumit the form We will have a test that will carry out these steps and ensure no error is thrown. If an error is thrown, then our tests fail and we will have to investigate what went wrong.

Getting started testing Adonis apps

@adonisjs/vow, the standard library built for the framework uses chai under the hood for assertions. We will mainly be testing using assertions. Get started by installing vow

adonis install @adonisjs/vow

The installation adds three files to your project. Add the configuration to the aceProviders array of app.js

const aceProviders = [
  // ...other providers
  '@adonisjs/vow/providers/VowProvider'
]

You can see how testing works by testing example.spec.js

adonis test

Output

  Example
    ✓ make sure 2 + 2 is 4 (2ms)

   PASSED 

  total       : 1
  passed      : 1
  time        : 6ms

Pre-testing checklist: Suites and Traits

Below is the content of the example test file.

'use strict'

const { test } = use('Test/Suite')('Example')

test('make sure 2 + 2 is 4', async ({ assert }) => {
  assert.equal(2 + 2, 4)
})

Notice that we are destructuring the test function from Test/Suite. Since we are testing APIs, we need a JS version of Postman. This is provided by Test/ApiClient, a trait. Traits were implemented to keep the test runner lean, so any desired functionality is required when needed.

Basically, we obtain trait from Suite and require the Test/ApiClient trait. Since some of our routes require authentication, we also require the Auth/Client trait.

const { test, trait } = use("Test/Suite")("Example");

trait("Test/ApiClient");
trait("Auth/Client");

To understand more about Suites and Traits, I suggest you read the docs. The Adonis team did a job explaining Suites and Traits.

Our first tests

We will structure our tests such that each controller will contain tests for each method. Go ahead and delete example.spec.js, then run this

adonis make:test User -f
# output: create: test/functional/user.spec.js

Replace the content of user.spec.js with this

"use strict";

const { test, trait } = use("Test/Suite")("User");

trait("Test/ApiClient");
trait("Auth/Client");

const User = use("App/Models/User");

Testing registration

We'll follow the convention of using the present tense on test cases. Here, we are testing the register route and asserting that the status is 201.

test("registers a new user", async ({ client }) => {
  const response = await client
    .post(`/api/v1/register`)
    .send({
      email: "test-user@email.com",
      password: "some password",
      grade_system: "5",
    })
    .end();

  await response.assertStatus(201);
});

Kent C. Doods always says to ensure your test is working, feed it a wrong assertion. So we'll asset a 200 and run our tests.

- response.assertStatus(201);
+ response.assertStatus(200);

Now, run the tests

Our tests said expected 201 to equal 200. We know that it is meant to be 201, so it means our test is working. Now return the assertion to its previous state and run the tests again.

Huh 🤨? 400? Remember that the register() method in UserController.js returns errors for non-unique emails. We should probably write a test for that too eh? Change the email and run the test again.

Hurray 🎊! It worked! That felt manual and isn't ideal. You know what will be better? A separate testing database which will be migrated and seeded before any tests run and revert the migrations after all the tests have run.

Configuring the testing setup

First things first, let's create a testing DB. If you are using sqlite, create one in the database directory.

touch database/testing.sqlite

If you are using a different DB, create a testing database. Name it whatever you wish.

In .env.testing, add your database name

DB_DATABASE=testing

.env.testing is used to override the default values of .env when testing.
We will complete our configuration in vowfile.js. vowfile.js is used for pre-tests and post-tests setup. First of all, uncomment the ace import: // const ace = require('@adonisjs/ace'). In the runner.before function, uncomment // await ace.call('migration:run', {}, { silent: true }) and add this below it

    await ace.call('seed', {}, { silent: true })

Likewise, in runner.after, uncomment // await ace.call('migration:reset', {}, { silent: true }).

Now, run your tests multiple times to verify that we don't run into that 400 again.

Testing an auth only route:

Let's test a route that requires authentication: update/profile. First, we will create the case alongside a test user.

test("updates a user's profile", async ({ client }) => {
  const user = await User.create({
    email: "some-other-email@email.com",
    password: "some password",
  });
});

Then we call the API with a loginVia method attached. Note that we won't be able to use loginVia without requiring trait("Auth/Client"). Finally, we assert the status to be 200 and the returned JSON to contain the names.

  response.assertStatus(200);

  response.assertJSONSubset({
    firstName: "John",
    lastName: "Doe",
  });

We could have also used assertJSON, but it will require that we include every field of the returned JSON. This may not be ideal for every case. Learn more about assertions here.

Test the new test case.

So, what now?

Now, you test the other routes. Write as many test cases as you deem fit. If you compare your tests with mine, checkout the main branch on this repo

Farewell

It's been 5 articles of bravery and honour. It can't deny how impressed I am to see you become an Adonis hero my young warlock. No that's not right, we've been writing APIs 😂. But it's been quite a journey. I hope you enjoyed every bit of it. Please I need your honest feedback on

The tutorial style
If I explained too much
The minimal use of images and memes. Feel free to add a comment. I really want to grow as a writer and your feedback matters a lot. Thank you for following along. Adios ✌🏾🧡.

CGPA Calculator with AdonisJS: DB Seeding

Osinachi Chukwujama — Sat, 05 Dec 2020 20:32:12 +0000

Hey there, welcome to the 4th tutorial in the series. In the previous tutorial, we created CRUD methods for the Course model. If you will like to skip the previous steps, clone the repo and checkout to the courses-crud-and-relationships branch, then code along.

Computing the cumulative

The goal of this API is to compute a student's CGPA. There are several different systems for computing CGPA. For this tutorial, we will stick with the 4 and 5 point systems.

4 Point System

The 4 point system follows this mapping

Grade	Points
A	4
B	3
C	2
D	1
F	0

5 Point System

And the that of the 5 point system is:

Grade	Points
A	5
B	4
C	3
D	2
F	0

Now, if we were to compute a student's CGPA given these details

const courses = [
  {
    code: "MTH 304",
    grade: "B",
    credit_load: 4,
  },
  {
    code: "GSW 102",
    grade: "A",
    credit_load: 3,
  },
  {
    code: "VEY 201",
    grade: "D",
    credit_load: 1,
  },
  {
    code: "WOR 423",
    grade: "F",
    credit_load: 2,
  },
];

We will follow this algorithm

let total_grade_point = 0
let total_credit_load = 0
for (course of courses){
   total_grade_point += course.grade * course.credit_load
   total_credit_load += course.credit_load
}
const cgpa = total_grade_point/total_credit_load

If you notice total_grade_point += course.grade * course.credit_load has a multiplication of a string and number. We need a way to convert. Like a lookup table. We can either save this table in our code or database. We will go with the later. This is where seeding comes in. We will seed the lookup table with data. We will call this lookup table grade_systems.

The GradeSystem model

Start by creating the model and its migration.

adonis make:model GradeSystem -m

In the grade_system_schema migration file, add these two column difiners.

      table.integer("point").notNullable();
      ["A", "B", "C", "D", "E", "F"].map((grade) => {
        table.integer(grade).unsigned();
      });

You can remove the table.timestamps() definer to make your table cleaner. If you do remove it, add these static getters to your GradeSystem model. Learn more from the docs.

  static get createdAtColumn() {
    return null;
  }
  static get updatedAtColumn() {
    return null;
  }

The GradeSystem seeder

Create a seeder using the CLI.

adonis make:seeder GradeSystem

Then add replace the content of GradeSystemSeeder.js with this:

"use strict";

const GradeSystem = use("App/Models/GradeSystem");

class GradeSystemSeeder {
  async run() {
    const points = [4, 5];
    for (let point of points) {
      const system = new GradeSystem();
      system.point = point;

      ["A", "B", "C", "D"].map((grade, index) => {
        system[grade] = point - index;
      });

      system["F"] = 0;

      await system.save();
    }
  }
}

module.exports = GradeSystemSeeder;

Now, run the pending migration and simultaneously seed the database.

adonis migration:run --seed

User preferences

Since we won't know by default the grade_system of our users, we need to give them the option of changing it. We will do that in preferences. First, we will create a model and migration.

adonis make:model Preference -m

Add these defines to the migration.

      table
        .integer("grade_system_id")
        .unsigned()
        .references("id")
        .inTable("grade_systems")
        .onUpdate("CASCADE")
        .onDelete("SET NULL");
      table
        .integer("user_id")
        .unsigned()
        .nullable()
        .references("id")
        .inTable("users")
        .onUpdate("CASCADE")
        .onDelete("CASCADE");

They are basically foreign keys that point to the grade_systems and users tables. The Preference and GradeSystem models share a 1:1 relationship. It makes more sense to say that a Preference maps to a GradeSystem. This means we will define the relationship in the Preference model.

// inside Preference.js
 gradeSystem() {
    return this.belongsTo("App/Models/GradeSystem");
  }

To get the GradeSystem of a Preference, we simply do

await preference.gradeSystem().fetch()

Cumulative model

We're back to cumulative. Go ahead and create a model and migration file.

adonis make:model Cumulative -m

Add these column definers to the cumulative migration file.

      table.integer("credit_load").unsigned();
      table.integer("grade_point").unsigned();
      table.decimal("grade_point_average", 20, 2).unsigned();
      table
        .integer("user_id")
        .unsigned()
        .nullable()
        .unique()
        .references("id")
        .inTable("users")
        .onUpdate("CASCADE")
        .onDelete("CASCADE");

We set a 2 decimal places precision to the grade_point_average with a max number length of 20 characters. Run the migration.

adonis migration:run

Now that we have the preferences and cumulatives tables set up, we can handle the relationships. When a user registers, we want to initialize a row on the cumulative and preferences tables. To do these, we will create the models and associate them with the User model. First, require these models.

const Preference = use("App/Models/Preference");
const GradeSystem = use("App/Models/GradeSystem");

Then create a new instance of the each model in the register method of UserController.

      const preference = new Preference();
      const cumulative = await Cumulative.create({
        credit_load: 0,
        grade_point: 0,
        grade_point_average: 0,
      });

It makes sense to collect the user's preferred grading system during registration. So, let's make that an optional field. Add grade_system to your request.all() so it becomes this

      const { email, password, grade_system } = request.all();

In the rules, add an enum rule for the grade_system

      const rules = {
        email: "required|email|unique:users,email",
        password: "required",
        grade_system: "in:4,5",
      };

Save the required grade_system instance to a variable gradeSystemInstance. If the grade system isn't provided, we set it as 5.

      const gradeSystemInstance = await GradeSystem.findBy(
        "point",
        grade_system | "5"
      );

Notice we didn't use query() to find this instance. findBy is a static method of a Lucid model. Learn more from the docs.

Since we have already defined the relationship between Preference and GradeSystem as

  // App/Models/Preference.js
  gradeSystem() {
    return this.belongsTo("App/Models/GradeSystem");
  }

we will use associate to bind them.

      // UserController.js register() method
      await preference.gradeSystem().associate(gradeSystemInstance);

associate is used on belongsTo. Learn more about Lucid relationships from the docs.

The last thing left is to tie the cumulative and preference instances to the user. Since they are both 1:1 relationships, we will use hasOne to define them. Inside app/Models/User.js, add these methods

  cumulative() {
    return this.hasOne("App/Models/Cumulative");
  }
  preference() {
    return this.hasOne("App/Models/Preference");
  }

Now, in the register method, we will use save instead of associate to register the foreign keys.

      await user.preference().save(preference);
      await user.cumulative().save(cumulative);

The rule of thumb is to use save with

hasOne
hasMany and use associate when using the inverse of hasOne i.e. belongsTo. Please refer to the docs for more info on relationships.

Cumulative controller

Create the cumulative controller by running this

adonis make:controller Cumulative --type=http

We need two methods. One for returning the computed CGPA and another for computing the CGPA. We will use a GET request for the first and a PATCH request for the second. Add these routes to routes.js

 Route.get("cumulative", "CumulativeController.show").middleware(["auth"]);
 Route.patch("cumulative", "CumulativeController.update").middleware(["auth"]);

First things first for the controller, we import the cumulative model. We also add the course and preference models because we'll be making use of them.

// CumulativeController.js
const Cumulative = use("App/Models/Cumulative");
const Course = use("App/Models/Course");
const Preference = use("App/Models/Preference");

Now, for the GET request, we simply return the cumulative. So our method will be

  async show({ auth, response }) {
    try {
      const user = await auth.user;
      const cumulative = await Cumulative.findBy("user_id", user.id);

      return response.status(200).send(cumulative);
    } catch (error) {
      return response.status(500).send(error);
    }
  }

The PATCH request is more involved. We will first calculate the cumulative before saving and returning it. We start of by finding the user's cumulative and grading system.

async update({ auth, response }) {
    try {
      const user = await auth.user;
      const cumulative = await Cumulative.findBy("user_id", user.id);
      const preference = await Preference.findBy("user_id", user.id);
      const grade_system = await preference.gradeSystem().fetch();

    } catch (error) {
      console.log(error);
      return response.status(500).send(error);
    }
  }

Then we query the user's courses

      // update method: CumulativeController.js
      const raw_courses = await Course.query()
        .where("user_id", user.id)
        .fetch();
      const courses = raw_courses.toJSON();

Afterwards, we compute the total_credit_load and total_grade_point.

      // update method: CumulativeController.js
     const total_credit_load = courses.reduce((accumulator, course) => {
        return accumulator + course.credit_load;
      }, 0);
      const total_grade_point = courses.reduce((accumulator, course) => {
        return accumulator + course.credit_load * grade_system[course.grade];
      }, 0);

Finally, we replace the existing cumulative values with the newly computed values, persist it to the DB and return the cumulative.

      // update method: CumulativeController.js
      cumulative.credit_load = total_credit_load;
      cumulative.grade_point = total_grade_point;
      cumulative.grade_point_average = Number(
        (total_grade_point / total_credit_load).toFixed(2)
      );

      await cumulative.save();
      return response.status(200).send(cumulative);

Here's the response of the PATCH request.

That's it. You did it. We are done! Congrats on making it this far. Are we missing something? How can we be confident that all the code we've written so far won't break in production 🤔? There's only one way to be sure. We write tests!

Recap

Before we go on to write tests, let's review what we learned in this tutorial.

How to create a seeder
How to run migrations and seed simultaneously.

Thank you for following along. In the next tutorial, we will write functional tests for our APIs. Thank you for following along. Adios ✌🏾🧡.

CGPA Calculator with AdonisJS: CRUD and Relationships

Osinachi Chukwujama — Sat, 05 Dec 2020 20:31:27 +0000

Hey there, welcome to the third tutorial in the series. In the previous tutorial, we added authentication to our APIs. If you will like to skip the previous steps, clone the repo and checkout to the authentication branch, then code along.

The course model

The course model has 8 fields with 2 timestamps. To add the course table to our database, we

Create the Course model with migrations
Modify the migration file to include necessary fields
Run the migration

Creating the Course model with migrations

adonis make:model Course -m

# Output
# ✔ create  app/Models/Course.js
# ✔ create  database/migrations/1606416525019_course_schema.js

The -m flag creates the migration file.

Setting the required fields

Open the newly created course_schema and add this code

      table.string("title").nullable();
      table.string("code").notNullable();
      table.enu("grade", ["A", "B", "C", "D", "F"]).notNullable();
      table.integer("credit_load").unsigned().notNullable();
      table.enu("semester", [1, 2, 3, 4]).notNullable();
      table
        .enu("level", [100, 200, 300, 400, 500, 600, 700, 800, 900])
        .notNullable();
      table
        .integer("user_id")
        .unsigned()
        .nullable()
        .references("id")
        .inTable("users")
        .onUpdate("CASCADE")
        .onDelete("CASCADE");

Notice that grade and level are implemented with table.enu. An enum only allows defined values. Refer to knex.js docs for more info on datatypes. The last column, user_id is a foreign key.

      table
        .integer("user_id")
        .unsigned()
        .nullable()
        .references("id")
        .inTable("users")
        .onUpdate("CASCADE")
        .onDelete("CASCADE");

Notice the onUpdate("CASCADE") and onDelete("CASCADE") attached? This means that changes in the user will reflect here. If the user is deleted, the courses with their id are also deleted.

Go ahead and run the migration.

adonis migration:run

Course CRUD routes

If we were to create individual routes for CRUD, we will end up with >4 routes.

Route.get('course', 'CourseController.index')
Route.post('course', 'CourseController.store')
Route.get('course/:id', 'CourseController.show')
Route.put('course/:id', 'CourseController.update')
Route.delete('course/:id', 'CourseController.destroy')

Adonis gives us a cleaner way to handle such routing: Route Resources! Add this line to routes.js

  Route.resource("courses", "CourseController").apiOnly().middleware(["auth"]);

Refer to the docs for more info on the apiOnly and route resources in general.

Course Controller

We will add logic for the five methods above: index, store, show, update and destroy. But first, let import the necessary.

const Course = use("App/Models/Course");
const { validateAll } = use("Validator");

The `store` method

Add the store method below to CourseController.js.

  async store({ auth, request, response }) {
    try {
      const {
        title,
        grade,
        code,
        credit_load,
        semester,
        level,
      } = request.all();

      const rules = {
        title: "required",
        grade: "required|in:A,B,C,D,F",
        code: "required",
        credit_load: "required|integer",
        semester: "required|in:1,2",
        level: "required|in:100,200,300,400,500,600,700,800,900",
      };

      const validation = await validateAll(request.all(), rules);

      if (validation.fails()) {
        return response.status(400).send(validation.messages());
      }

      const course = await Course.create({
        title,
        grade,
        code,
        credit_load,
        semester,
        level
      });

      const user = await auth.getUser();
      await user.courses().save(course);

      return response.status(201).send(course);
    } catch (error) {
      console.log(error);
      return response.status(500).send(error);
    }
  }

If you compare the rules and the datatypes defined in the migration, you'll discover the similarity between them. If we weren't using a validator, the database will throw errors when we try inserts or updates with wrong data. But it's best to validate data at the application layer.

A very interesting part of the store method is how relationships are handled. Since user and courses share a 1:N relationship, we need to tell the database to set a foreign key for each course created. We do that using

await user.courses().save(course);

In our User Lucid model, we will define a courses method like so

  courses() {
    return this.hasMany("App/Models/Course");
  }

This method returns a relationship binder linked to Course. So when the save method is called on this method, the user's id will be inserted in the user_id field of the course in the database. This may seem confusing at first, but to better understand it, we need to create courses.

Creating courses

Prop open your favourite API testing app and call this route POST /api/v1/courses. Ensure you have the right JWT set. You can use the JSON below for your request body

{
    "title": "Metals and Non metals",
    "grade": "A",
    "code": "MNM 304",
    "credit_load": "4",
    "semester": "2",
    "level": "100"
}

You should get a response similar to

{
    "title": "Metals and Non metals",
    "grade": "A",
    "code": "MNM 304",
    "credit_load": "4",
    "semester": "2",
    "level": "100",
    "created_at": "2020-11-27 00:46:00",
    "updated_at": "2020-11-27 00:46:00",
    "id": 4,
    "user_id": 1
}

You can go ahead and prevent the created_at, updated_at and user_id fields from showing up by adding this to the Course model.

  static get hidden() {
    return ["created_at", "updated_at", "user_id"];
  }

Returning created courses

Single course

To return a single course, we will utilize a request parameter for course id.

  async show({ auth, params, response }) {
    try {
      const course = await Course.find(params.id);

      if (!course) {
        return response.status(404).send("Course not found");
      }

      const courseOwner = await course.user().fetch();
      const requester = await auth.user;
      if (requester.id !== courseOwner.id) {
        return response
          .status(403)
          .send("You cannot view another user's course");
      }
      return response.status(200).send(course);
    } catch (error) {
      return response.status(500).send(error);
    }
  }

First, we find a course that matches the given id. If no such course exists, we return a 404. We obtain the course owner by calling the user() method on the course Lucid model. Remember how we used hasMany when we were defining the relationship between user and course? Now, we will use belongsTo to define the inverse relationship. Add the user method below to your Course model.

user() {
    return this.belongsTo("App/Models/User");
}

Back to the show method. We check that the course owner's id matches the user calling the route. If it doesn't, we return a 403 else we return the course. Below is an attempt to return a single course.

Multiple courses

To return multiple courses, we use the index method.

  async index({ auth, request, response }) {
    try {
      const { semester, level } = request.all();

      const rules = {
        semester: "in:1,2",
        level: "in:100,200,300,400,500,600,700,800,900",
      };

      const validation = await validateAll(request.all(), rules);

      if (validation.fails()) {
        return response.status(400).send(validation.messages());
      }

      const user_id = await auth.user.id;

      let courses;

      if (level && !semester) {
        courses = await Course.query()
          .where({ user_id: user_id, level: level })
          .fetch();
      } else if (level && semester) {
        courses = await Course.query()
          .where({ user_id: user_id, level: level, semester: semester })
          .fetch();
      } else {
        courses = await Course.query().where("user_id", user_id).fetch();
      }

      return response.status(200).send(courses);
    } catch (error) {
      console.log(error);
      return response.status(500).send(error);
    }
  }

A user calling this API has three options

/courses returns all of a user's courses
/courses?level=300 returns all of a user's 300 level courses
/courses?level=100&semester=1 returns all of a user's 300 level, 1st semester courses. The logic to determine the right query to perform is

      let courses;

      if (level && !semester) {
        courses = await Course.query()
          .where({ user_id: user_id, level: level })
          .fetch();
      } else if (level && semester) {
        courses = await Course.query()
          .where({ user_id: user_id, level: level, semester: semester })
          .fetch();
      } else {
        courses = await Course.query().where("user_id", user_id).fetch();
      }

Notice that we used fetch when using the where clause abstraction. You can learn more about queries from the docs.

Course updates using the `update` method

Updating a course is very similar to creating one. We make every field required and find the course from the params. We then check if the course belongs to the user requesting it. If all goes well, we update the course fields and save it. Below is an incomplete update method. Your job is to complete it. Feel free to modify it if you think about a better implementation.

  async update({ auth, params, request, response }) {
    try {

      // your code above

      const courseOwner = await course.user().fetch();
      const requester = await auth.user;
      if (requester.id !== courseOwner.id) {
        return response
          .status(403)
          .send("You cannot view another user's course");
      }

      course.title = title;
      course.grade = grade;
      course.code = code;
      course.credit_load = credit_load;
      course.semester = semester;
      course.level = level;

      await course.save();
      return response.status(200).send(course);
    } catch (error) {
      console.log(error);
      return response.status(500).send(error);
    }
  }

Notice that we used the same logic to verify that the user making the request is a course's owner. We can refactor that logic to this method.

  async isOwner({ auth, course, response }) {
    const courseOwner = await course.user().fetch();
    const requester = await auth.user;
    if (requester.id !== courseOwner.id) {
      throw new Error("You cannot view another user's course");
    }
  }

Now, to call it, we do

      try {
        await this.isOwner({ auth, course, response });
      } catch (error) {
        return response
          .status(403)
          .send("You cannot <action> another user's course");
      }

You may find it ironic that the refactor added more code to the codebase. The good part of it is that we can easily change our logic in one place.

Course deletion

Course deletion is probably the simplest here. It only involves verification and deletion.

  async destroy({ auth, params, response }) {
    try {
      const course = await Course.find(params.id);
      if (!course) {
        return response.status(404).send("Course not found");
      }
      try {
        await this.isOwner({ auth, course, response });
      } catch (error) {
        return response
          .status(403)
          .send("You cannot delete another user's course");
      }
      await course.delete();
      return response.send("course deleted successfully");
    } catch (error) {
      return response.status(500).send("An error occured");
    }
  }

If you notice, Lucid models simplify DB operations. Deletion is simply course.delete() instead of delete from courses where id =<id>.

What you've learned so far

Generating models and migrations
Cascade update and delete
Route resources
A simple way to handle authorization

Next steps

In the next tutorial, we will look into 1:1 relationship and how we can seed our database. Thank you for following along. Adios ✌🏾🧡.

Build a CGPA Calculator with AdonisJS: Authentication

Osinachi Chukwujama — Mon, 30 Nov 2020 10:34:42 +0000

Hey there, welcome to the second tutorial in the series. Refer to the first tutorial here. If you will like to skip setup, clone the repo and checkout to the getting-started branch.

Authentication for APIs

Securing APIs can be done in a number of ways. From API keys to JSON Web Token (JWT). AdonisJS is so awesome that it comes configured with several authentication methods. We will be using JWT to secure our APIs. Refer to AdonisJS authentication documentation for more info.

The first step is to change the authenticator value in auth.js from session to jwt.

 - authenticator: 'session',
 - authenticator: 'jwt',

Now, in the routes.js file, add routes for registration and login.

  Route.post("register", "UserController.register").middleware("guest");
  Route.post("login", "UserController.login").middleware("guest");

CSRF Protection

According to OWAPS

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated.
CSRF attacks mainly apply to web forms (POST, PATCH, DELETE) and pages (GET). Here's a StackOverflow answer further explaining this. Learn more about CSRF from this video.

%[https://www.youtube.com/watch?v=eWEgUcHPle0]

Since we are purely building APIs we won't have to worry about CSRF, so we can safely disable it. In shield.js, set the enable key of the csrf field to false.

  // shield.js
  csrf: {
    - enable: true,
    + enable: false,
    methods: ['POST', 'PUT', 'DELETE'],
    filterUris: [],
    cookieOptions: {
      httpOnly: false,
      sameSite: true,
      path: '/',
      maxAge: 7200
    }
  }

Auth routes

We will start API versioning right from the start. Create an auth group with two POST requests.

Route.group(() => {
  Route.post("register", "UserController.register").middleware("guest");
  Route.post("login", "UserController.login").middleware("guest");
}).prefix("api/v1");

These routes have a middleware("guest") attached to them. This means only requests without valid JWT will work. In essence, these routes are publicly exposed. Note the use of UserController. This means these routes will be handled by the register and login methods of the user controller which we will create in a bit.

User controller

Create the user controller by running. Select HTTP requests when prompted.

adonis make:controller User

# > Select controller type 
# ‣ For HTTP requests
#  For Websocket channel

# output
# ✔ create  app/Controllers/Http/UserController.js

You can shorten this to

adonis make:controller User --type=http

We will add the register, login and other methods concerning the User model here.

Models and tables

Adonis has a database provider called Lucid. Lucid is used for CRUD operations on tables. If you look into the app/Models directory, you will find two files: User.js and Token.js. These models represent database tables. Analysing the User model shows that this model extends the Model class which is from Lucid.

/** @type {typeof import('@adonisjs/lucid/src/Lucid/Model')} */
const Model = use("Model");

class User extends Model { ... }

Ideally, each table you create should be created from a model. We execute business logic in controllers using models to simplify CRUD operations.

User registration

First, import the User Lucid model using this syntax.

const User = use("App/Models/User");

Add this method to the UserController.js file. Notice the auth, request and response destructured objects on the method. Unlike in ExpressJS, the auth method is available to all controller methods.

  async register({ auth, request, response }) {
    try {
      const { email, password } = request.all();

      const user = await User.create({
        email,
        password,
      });

      const authedUser = await auth.withRefreshToken().attempt(email, password);
      return response.status(201).send(authedUser);
    } catch (error) {
      console.log(error);
      return response.status(500).send(error);
    }
  }

A user is created with User.create and is authenticated using their email and password.

User login

Add this method below the register method


  async login({ auth, request, response }) {
    try {
      const { email, password } = request.all();

      const authedUser = await auth.withRefreshToken().attempt(email, password);

      return response.status(200).send(authedUser);
    } catch (error) {
      return response.status(404).send(error);
    }
  }

Notice how insecure the API is? If a user loses their password, an attacker can perform malicious activities on the user's account. We can solve this by adding 2FA using email or adopting OAuth.

Validating request data

Installing @adonisjs/validator

AdonisJS offers a first part package called indicative for handling validation. We can include it in our project using the @adonisjs/validator package. Run this command to include it

adonis install @adonisjs/validator

# Output
# [1/1] 📦  Dependencies installed [@adonisjs/validator]

Notice the use of adonis install. It uses npm under the hood and runs some setup instructions within the package like opening setup instructions within in your browser. Now, add @adonisjs/validator/providers/ValidatorProvider to the providers array in start/app.js. Refer to the validator docs for more info.

Setting up validation in UserContoller

The validateAll method helps us validate all fields before resolving. Require validateAll in UserController.js.

const { validateAll } = use("Validator");

Here are three steps for handling validation. Add them to the register() method:

Define rules

      const rules = {
        email: "required|email|unique:users,email",
        password: "required|min:8"
      };

Validate request data

      const validation = await validateAll(request.all(), rules);

Return validation errors if any

      if (validation.fails()) {
        return response.status(400).send(validation.messages());
      }

Ensure you do all these above the user creation.

      const user = await User.create({
        email,
        password,
      });

Follow the same steps for login method but use these rules instead.

      const rules = {
        email: "required|email",
        password: "required",
      };

Testing what we have so far

Ensure your server is running. Test the /register and /login routes using your favourite API testing app.

Here's what a successful registration will return

And here' a registration attempt with error messages should look like

Notice how the errors are returned as JSON. It is up to you to either modify these error messages to suit the API consumer or return them as is.

Getting a user's profile (where auth comes into play)

To get a user's profile, we first add the GET route in routes.js

  Route.get("/users/profile", "UserController.show").middleware(["auth"]);

Notice that this route has the auth middleware attached. An error will be thrown for requests without a valid JWT token. Add this show method to UserController.js.

  async show({ auth, response }) {
    try {
      const user = await auth.user;
      return response.status(200).send(user);
    } catch (error) {
      return response.status(500).send(error);
    }
  }

To test the GET /users/profile route, we add the JWT obtained from registration or login to the Authorization request header. In postman, we do this in the Auth tab.

Handling profile update

A user must be authenticated to update their profile. We have several routes handling profile updates.

/users/profile
/users/email
/users/password

I'll handle the first and second. You can attempt the third on your own. You can always check what I did in the authentication branch of this repo for the complete code.

First things first, add these routes to your routes.js file.

  Route.patch("/users/profile", "UserController.updateProfile").middleware([
    "auth",
  ]);
  Route.patch("/users/email", "UserController.updateEmail").middleware([
    "auth",
  ]);
  Route.patch("/users/password", "UserController.updatePassword").middleware([
    "auth",
  ]);

Profile update

We will use the method below to update a user's profile.

  async updateProfile({ auth, request, response }) {
    try {
      const { firstName, lastName } = request.all();
      const rules = {
        firstName: "required",
        lastName: "required",
      };
      const validation = await validateAll(request.all(), rules);

      if (validation.fails()) {
        return response.status(400).send(validation.messages());
      }

      const user = await auth.user;
      user.firstName = firstName;
      user.lastName = lastName;

      await user.save();
      return response.status(200).send(user);
    } catch (error) {
      return response.status(500).send(error);
    }
  }

Profile here refers to firstName and lastName. We can always more fields later using migrations. Notice how we used user.save() to persist the changed values to the DB. Adonis figures if it's going to create a new row or update an existing one.

On successful update, you should have a response similar to.

Notice the password, created_at and updated_at fields. These fields are unnecessary, especially the password field. We exclude these fields from being returned by adding a hidden getter to the User model.

  static get hidden() {
    return ["password", "created_at", "updated_at", "id"];
  }

You may want to exclude the id also.

Email update

To update email, we follow the same steps as above. Only diff here are the rules

      const rules = {
        email: "required|email|unique:users,email",
      };

and the save logic

      const user = await auth.user;
      user.email = email;

      await user.save();

Password update

You can handle the logic for new password however you wish. Here's a snippet for verifying that the current password matches the new one.

      const passwordsMatch = await Hash.verify(currentPassword, user.password)

      if (!passwordsMatch) {
        return response.status(400).send("Supplied password is wrong");
      }

Hash is part of built-in Adonis helpers. Ensure you require Hash using.

const Hash = use("Hash");

This brings us to the end of the authentication tutorial. Checkout to the authentication branch on this github repo if you need the complete code. Let's recap what we've learned so far.

Recap

How to set up JWT authentication in AdonisJS
What CSRF is
How to set up controllers in AdonisJS
How to handle validation in controller methods

Please provide feedback in the comment section if you run into any problem. Give a few likes, I appreciate that. Thanks for following along. Adios ✌🏾🧡.

Forem: Osinachi Chukwujama

Automating User Management and Permissions on Linux using Bash Scripting

Requirements

Creating users

Adding users to groups

Creating groups

Combining user creation, group creation, and group addition

Securing the script: Hashing passwords with openssl

Encrypting and storing the passwords

A look at the secure script

Adding logging to the script

Adding Error Handling

Conclusion

wget tips

Save a file with an extension and desired filename

docker login azure fails

docker login azure fails

How I Built the Best Tic-Tac-Toe Game Ever

What I built

Category Submission:

App Link

Screenshots

Description

Link to Source Code

Permissive License

Background

How I built it

How to deploy an AdonisJS app and Redis to Digital Ocean

Introduction

Getting started

Deploying a Redis Cluster

Step 1: Navigating to the databases page

Step 2: Choose a Datacenter

Step 3: Choose a Database Cluster Name

Deploying the Adonis App

Step 1: Choose Your Repo

Step 2: Choose an App Name, Region and Branch

Step 3: Configure Your App

App Key and Redis Connection

Setting the run command

Step 4: Setting the app's plan

A note about TLS

Conclusion

Building a Multiplayer TicTacToe Game

How the game is structured

Deploying To Digital Ocean

What I learned about deployment

Learn Laravel as a Nodejs Developer using AdonisJS

Similarities between Laravel and Adonis

Differences

So how do I learn Adonis.js?

So after learning Adonis, how do I learn Laravel?

Benefits of developing with Laravel

Algorithmic walkthrough: Merging 2 Packages

Problem Analysis

Parameters

Requirements

Naive Solution

Time complexity

More efficient solution

Time complexity

Space complexity

Conclusion

CGPA Calculator with AdonisJS: API Testing

Functional Testing

Getting started testing Adonis apps

Pre-testing checklist: Suites and Traits

Our first tests

Testing registration

Configuring the testing setup

Testing an auth only route:

So, what now?

Farewell

CGPA Calculator with AdonisJS: DB Seeding

Computing the cumulative

4 Point System

5 Point System

The GradeSystem model

The GradeSystem seeder

User preferences

The `store` method

Course updates using the `update` method