juice-shop

1
/*
2
 * Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
3
 * SPDX-License-Identifier: MIT
4
 */
5

6
import { type Request, type Response, type NextFunction } from 'express'
7
import { UserModel } from '../models/user'
8
import { WalletModel } from '../models/wallet'
9
import { CardModel } from '../models/card'
10
import challengeUtils = require('../lib/challengeUtils')
11
import * as utils from '../lib/utils'
12
import { challenges } from '../data/datacache'
13

14
const security = require('../lib/insecurity')
15

16
module.exports.upgradeToDeluxe = function upgradeToDeluxe () {
17
  return async (req: Request, res: Response, next: NextFunction) => {
18
    try {
19
      const user = await UserModel.findOne({ where: { id: req.body.UserId, role: security.roles.customer } })
20
      if (user == null) {
21
        res.status(400).json({ status: 'error', error: 'Something went wrong. Please try again!' })
22
        return
23
      }
24
      if (req.body.paymentMode === 'wallet') {
25
        const wallet = await WalletModel.findOne({ where: { UserId: req.body.UserId } })
26
        if ((wallet != null) && wallet.balance < 49) {
27
          res.status(400).json({ status: 'error', error: 'Insuffienct funds in Wallet' })
28
          return
29
        } else {
30
          await WalletModel.decrement({ balance: 49 }, { where: { UserId: req.body.UserId } })
31
        }
32
      }
33

34
      if (req.body.paymentMode === 'card') {
35
        const card = await CardModel.findOne({ where: { id: req.body.paymentId, UserId: req.body.UserId } })
36
        if ((card == null) || card.expYear < new Date().getFullYear() || (card.expYear === new Date().getFullYear() && card.expMonth - 1 < new Date().getMonth())) {
37
          res.status(400).json({ status: 'error', error: 'Invalid Card' })
38
          return
39
        }
40
      }
41

42
      user.update({ role: security.roles.deluxe, deluxeToken: security.deluxeToken(user.email) })
43
        .then(user => {
44
          challengeUtils.solveIf(challenges.freeDeluxeChallenge, () => { return security.verify(utils.jwtFrom(req)) && req.body.paymentMode !== 'wallet' && req.body.paymentMode !== 'card' })
45
          // @ts-expect-error FIXME some properties missing in user
46
          user = utils.queryResultToJson(user)
47
          const updatedToken = security.authorize(user)
48
          security.authenticatedUsers.put(updatedToken, user)
49
          res.status(200).json({ status: 'success', data: { confirmation: 'Congratulations! You are now a deluxe member!', token: updatedToken } })
50
        }).catch(() => {
51
          res.status(400).json({ status: 'error', error: 'Something went wrong. Please try again!' })
52
        })
53
    } catch (err: unknown) {
54
      res.status(400).json({ status: 'error', error: 'Something went wrong: ' + utils.getErrorMessage(err) })
55
    }
56
  }
57
}
58

59
module.exports.deluxeMembershipStatus = function deluxeMembershipStatus () {
60
  return (req: Request, res: Response, next: NextFunction) => {
61
    if (security.isCustomer(req)) {
62
      res.status(200).json({ status: 'success', data: { membershipCost: 49 } })
63
    } else if (security.isDeluxe(req)) {
64
      res.status(400).json({ status: 'error', error: 'You are already a deluxe member!' })
65
    } else {
66
      res.status(400).json({ status: 'error', error: 'You are not eligible for deluxe membership!' })
67
    }
68
  }
69
}
70