Merge pull request #46 from sebastiankrll/feature/vatsim-auth

Feature/vatsim auth

Author: sebastiankrll

apps/api/package.json

@@ -12,6 +12,7 @@
 		"@sr24/typescript-config": "*",
 		"@types/cors": "^2.8.19",
 		"@types/express": "^5.0.5",
+		"@types/jsonwebtoken": "^9.0.10",
 		"@types/ws": "^8.18.1",
 		"@types/xml2js": "^0.4.14",
 		"tsup": "^8.5.0",
@@ -25,6 +26,7 @@
 		"express": "^5.1.0",
 		"express-rate-limit": "^8.2.1",
 		"helmet": "^8.1.0",
+		"jsonwebtoken": "^9.0.3",
 		"xml2js": "^0.6.2"
 	}
 }

apps/api/src/auth.ts

@@ -0,0 +1,48 @@
+import type { NextFunction, Request, Response } from "express";
+import jwt from "jsonwebtoken";
+
+interface JWTPayload {
+	vatsim?: {
+		cid: number;
+	};
+	sub?: string;
+}
+
+export interface AuthRequest extends Request {
+	user?: {
+		cid: number;
+	};
+}
+
+export const authHandler = (req: AuthRequest, res: Response, next: NextFunction) => {
+	const authHeader = req.headers.authorization;
+	const token = authHeader?.split(" ")[1];
+
+	if (!token) {
+		res.status(401).json({ error: "Authentication required" });
+		return;
+	}
+
+	const secret = process.env.NEXTAUTH_SECRET;
+	if (!secret) {
+		console.error("NEXTAUTH_SECRET is not set");
+		res.status(500).json({ error: "Server configuration error" });
+		return;
+	}
+
+	try {
+		const decoded = jwt.verify(token, secret) as JWTPayload;
+
+		if (!decoded.vatsim?.cid) {
+			res.status(401).json({ error: "Invalid token" });
+			return;
+		}
+
+		req.user = {
+			cid: decoded.vatsim.cid,
+		};
+		next();
+	} catch (_err) {
+		res.status(403).json({ error: "Invalid or expired token" });
+	}
+};

apps/api/src/error.ts

@@ -0,0 +1,7 @@
+import type express from "express";
+
+export const errorHandler =
+	(fn: (req: express.Request, res: express.Response, next: express.NextFunction) => Promise<void> | Promise<any>) =>
+	(req: express.Request, res: express.Response, next: express.NextFunction) => {
+		Promise.resolve(fn(req, res, next)).catch(next);
+	};

apps/api/src/index.ts

@@ -1,10 +1,12 @@
 import "dotenv/config";
-import { pgFindAirportFlights, pgHealthCheck, pgShutdown } from "@sr24/db/pg";
+import { pgFindAirportFlights, pgHealthCheck, pgShutdown, prisma } from "@sr24/db/pg";
 import { rdsConnect, rdsGetMultiple, rdsGetRing, rdsGetSingle, rdsGetTimeSeries, rdsHealthCheck, rdsShutdown } from "@sr24/db/redis";
 import cors from "cors";
 import express from "express";
 import rateLimit from "express-rate-limit";
 import helmet from "helmet";
+import { type AuthRequest, authHandler } from "./auth.js";
+import { errorHandler } from "./error.js";
 import { validateCallsign, validateICAO, validateNumber, validateString } from "./validation.js";
 import { getMetar, getTaf } from "./weather.js";
 
@@ -29,18 +31,10 @@ app.use(cors());
 app.use(express.json());
 app.use(limiter);
 
-// Async error wrapper
-const asyncHandler =
-	(fn: (req: express.Request, res: express.Response, next: express.NextFunction) => Promise<void> | Promise<any>) =>
-	(req: express.Request, res: express.Response, next: express.NextFunction) => {
-		// console.log(`Incoming request: ${req.method} ${req.originalUrl}`);
-		Promise.resolve(fn(req, res, next)).catch(next);
-	};
-
 // Health check endpoints
 app.get(
 	"/health",
-	asyncHandler(async (_req, res) => {
+	errorHandler(async (_req, res) => {
 		const startTime = Date.now();
 		const health = {
 			status: "ok",
@@ -82,7 +76,7 @@ app.get(
 
 app.get(
 	"/health/live",
-	asyncHandler(async (_req, res) => {
+	errorHandler(async (_req, res) => {
 		res.json({
 			status: "alive",
 			timestamp: new Date().toISOString(),
@@ -92,7 +86,7 @@ app.get(
 
 app.get(
 	"/health/ready",
-	asyncHandler(async (_req, res) => {
+	errorHandler(async (_req, res) => {
 		try {
 			const redisHealthy = await rdsHealthCheck();
 			const pgHealthy = await pgHealthCheck();
@@ -126,7 +120,7 @@ app.get(
 
 app.get(
 	"/data/init",
-	asyncHandler(async (_req, res) => {
+	errorHandler(async (_req, res) => {
 		const all = await rdsGetSingle("ws:all");
 		if (!all) {
 			res.status(404).json({ error: "Initial data not found" });
@@ -142,7 +136,7 @@ app.get(
 
 app.get(
 	"/data/pilot/:id",
-	asyncHandler(async (req, res) => {
+	errorHandler(async (req, res) => {
 		const id = validateString(req.params.id, "Pilot ID", 1, 10);
 
 		const pilot = await rdsGetSingle(`pilot:${id}`);
@@ -157,7 +151,7 @@ app.get(
 
 app.get(
 	"/data/airport/:icao",
-	asyncHandler(async (req, res) => {
+	errorHandler(async (req, res) => {
 		const icao = validateICAO(req.params.icao).toUpperCase();
 
 		const airport = await rdsGetSingle(`airport:${icao}`);
@@ -172,7 +166,7 @@ app.get(
 
 app.get(
 	"/data/weather/:icao",
-	asyncHandler(async (req, res) => {
+	errorHandler(async (req, res) => {
 		const icao = validateICAO(req.params.icao).toUpperCase();
 		const metar = getMetar(icao);
 		const taf = getTaf(icao);
@@ -183,7 +177,7 @@ app.get(
 
 app.get(
 	"/data/controllers/:callsigns",
-	asyncHandler(async (req, res) => {
+	errorHandler(async (req, res) => {
 		const callsignArray = req.params.callsigns.split(",").map((cs) => validateCallsign(cs.trim()));
 
 		if (callsignArray.length === 0) {
@@ -204,7 +198,7 @@ app.get(
 
 app.get(
 	"/data/track/:id",
-	asyncHandler(async (req, res) => {
+	errorHandler(async (req, res) => {
 		const id = validateString(req.params.id, "Track ID", 1, 10);
 
 		// const trackPoints = await pgGetTrackPointsByid(id);
@@ -220,7 +214,7 @@ app.get(
 
 app.get(
 	"/data/aircraft/:reg",
-	asyncHandler(async (req, res) => {
+	errorHandler(async (req, res) => {
 		const reg = validateString(req.params.reg, "Aircraft Registration", 1, 10).toUpperCase();
 
 		const aircraft = await rdsGetSingle(`static_fleet:${reg}`);
@@ -235,7 +229,7 @@ app.get(
 
 app.get(
 	"/data/dashboard/",
-	asyncHandler(async (_req, res) => {
+	errorHandler(async (_req, res) => {
 		const stats = await rdsGetSingle(`dashboard:stats`);
 		const history = await rdsGetRing(`dashboard:history`, 24 * 60 * 60 * 1000);
 		const events = await rdsGetSingle(`dashboard:events`);
@@ -251,7 +245,7 @@ app.get(
 
 app.get(
 	"/data/airport/:icao/flights",
-	asyncHandler(async (req, res) => {
+	errorHandler(async (req, res) => {
 		const icao = validateICAO(req.params.icao).toUpperCase();
 		const direction = (String(req.query.direction || "dep").toLowerCase() === "arr" ? "arr" : "dep") as "dep" | "arr";
 		const limit = validateNumber(req.query.limit || 20, "Limit", 1, 30);
@@ -263,6 +257,48 @@ app.get(
 	}),
 );
 
+app.get(
+	"/user/settings",
+	authHandler,
+	errorHandler(async (req: AuthRequest, res) => {
+		const cid = BigInt(req.user?.cid || 0);
+
+		const user = await prisma.user.findUnique({
+			where: { cid },
+			select: { settings: true },
+		});
+
+		if (!user) {
+			res.status(404).json({ error: "User not found" });
+			return;
+		}
+
+		res.json({ settings: user.settings || {} });
+	}),
+);
+
+app.post(
+	"/user/settings",
+	authHandler,
+	errorHandler(async (req: AuthRequest, res) => {
+		const cid = BigInt(req.user?.cid || 0);
+		const settings = req.body;
+
+		if (!settings || typeof settings !== "object") {
+			res.status(400).json({ error: "Invalid settings data" });
+			return;
+		}
+
+		const user = await prisma.user.upsert({
+			where: { cid },
+			update: { settings },
+			create: { cid, settings },
+		});
+
+		res.json({ settings: user.settings });
+	}),
+);
+
 app.use((_req, res) => {
 	res.status(404).json({ error: "Endpoint not found" });
 });

apps/web/Dockerfile

@@ -21,9 +21,21 @@ COPY --from=prepare /app/out/full/ .
 ARG NEXT_PUBLIC_API_URL
 ARG NEXT_PUBLIC_WEBSOCKET_URL
 ARG NEXT_PUBLIC_R2_BUCKET_URL
+ARG API_URL
+ARG NEXTAUTH_SECRET
+ARG NEXTAUTH_URL
+ARG VATSIM_CLIENT_ID
+ARG VATSIM_CLIENT_SECRET
+ARG VATSIM_AUTH_URL
 ENV NEXT_PUBLIC_API_URL=$NEXT_PUBLIC_API_URL
 ENV NEXT_PUBLIC_WEBSOCKET_URL=$NEXT_PUBLIC_WEBSOCKET_URL
 ENV NEXT_PUBLIC_R2_BUCKET_URL=$NEXT_PUBLIC_R2_BUCKET_URL
+ENV API_URL=$API_URL
+ENV NEXTAUTH_SECRET=$NEXTAUTH_SECRET
+ENV NEXTAUTH_URL=$NEXTAUTH_URL
+ENV VATSIM_CLIENT_ID=$VATSIM_CLIENT_ID
+ENV VATSIM_CLIENT_SECRET=$VATSIM_CLIENT_SECRET
+ENV VATSIM_AUTH_URL=$VATSIM_AUTH_URL
 
 RUN npm run build
 

…eb/app/airport/[icao]/[...slug]/page.tsx …/(map)/airport/[icao]/[...slug]/page.tsxapps/web/app/airport/[icao]/[...slug]/page.tsx renamed to apps/web/app/(map)/airport/[icao]/[...slug]/page.tsx apps/web/app/airport/[icao]/[...slug]/page.tsx renamed to apps/web/app/(map)/airport/[icao]/[...slug]/page.tsx

@@ -0,0 +1,5 @@
+import OMap from "@/components/Map/Map";
+
+export default function MapLayout({ children }: { children: React.ReactNode }) {
+	return <OMap>{children}</OMap>;
+}