Merge pull request #47 from fuzziecoder/codex/fix-major-issue-in-backend

Fix broken authz check for GET /api/orders/:id

Author: fuzziecoder

backend/db.js

@@ -163,6 +163,21 @@ export const database = {
     );
   },
 
+  getUserById(userId) {
+    const user = state.users.find((entry) => entry.id === userId);
+
+    if (!user) {
+      return null;
+    }
+
+    return {
+      id: user.id,
+      username: user.username,
+      name: user.name,
+      role: user.role,
+    };
+  },
+
   userExists(userId) {
     return state.users.some((user) => user.id === userId);
   },

backend/server.js

@@ -48,6 +48,33 @@ const clearRateLimitState = (key) => {
   loginAttempts.delete(key);
 };
 
+const parseBearerToken = (authHeader) => {
+  if (typeof authHeader !== 'string') {
+    return null;
+  }
+
+  const [scheme, token] = authHeader.trim().split(/\s+/, 2);
+  if (!scheme || !token || scheme.toLowerCase() !== 'bearer') {
+    return null;
+  }
+
+  return token;
+};
+
+const getUserFromAuthHeader = (authHeader) => {
+  const token = parseBearerToken(authHeader);
+  if (!token || !token.startsWith('demo-token-')) {
+    return null;
+  }
+
+  const userId = token.slice('demo-token-'.length);
+  if (!userId) {
+    return null;
+  }
+
+  return database.getUserById(userId);
+};
+
 const recordFailedLoginAttempt = (key) => {
   const now = Date.now();
   const state = getRateLimitState(key);
@@ -181,8 +208,8 @@ const server = createServer(async (req, res) => {
   if (method === 'GET' && path.startsWith('/api/orders/')) {
     const orderId = path.replace('/api/orders/', '');
 
-    const authHeader = req.headers.authorization;
-    if (!authHeader) {
+    const authedUser = getUserFromAuthHeader(req.headers.authorization);
+    if (!authedUser) {
       sendJson(res, 401, { error: 'Unauthorized' });
       return;
     }
@@ -194,6 +221,12 @@ const server = createServer(async (req, res) => {
       return;
     }
 
+    const isAdmin = authedUser.role === 'admin';
+    if (!isAdmin && order.userId !== authedUser.id) {
+      sendJson(res, 403, { error: 'Forbidden' });
+      return;
+    }
+
     sendJson(res, 200, order);
     return;
   }