got this function to check if the username is an admin.
module.exports = {
checkAdmin: function(username){
var _this = this;
var admin = null;
sql.execute(sql.format('SELECT * FROM tbl_admins'), (err, result, fields) => {
if (err) {
logger.error(err.message);
return;
}
adminArray = []
result.forEach(element => {
if(element.Username == username){
adminArray.push(element.Username)
}
});
if (adminArray.includes(username)){
_this.admin = true;
}else{
_this.admin = false;
}
})
return admin;
} }
And this is in the Express file.
var check = Admin.checkAdmin(req.body.username);
if (check == false) {
console.log("Wrong")
res.send({
message: 'Access denied'
}); //bad request
return;
}
The SQL is correct. The problem is to set the variable "admin" inside the SQL function. The function returns "".
Thx
I can't help it but to notice that your whole checkAdmin function has a style I haven't seen before. Let me try to simplify it a bit, maybe it helps with the issue.
// Admin.js
// Return a Promise, so it's easier
// to deal with the asynchronous SQL Call
function checkAdmin (username) {
return new Promise((resolve, reject) => {
sql.execute(
sql.format('SELECT * FROM tbl_admins'),
(err, result, fields) => {
if (err) { return reject(err); }
let foundUser = false;
result.map((element) => {
if (element.Username == username) { foundUser = true; }
});
return resolve(foundUser);
});
});
}
module.exports = { checkAdmin };
๐ First we return a Promise. Then we stay inside the callback function from the SQL call. If there is an error err we reject the Promise. If there is no error we resolve the Promise with a boolean foundUser. If we find the wanted username inside the table foundUser will be true, otherwise it will be false.
Now keep in mind that checkAdmin returns a Promise now.
// Router Controller
const Admin = require('./Admin');
app.post('/some-route-only-admins-can-use', (req, res) => {
const username = req.body.username;
Admin.checkAdmin(username)
.then((isAdmin) => {
if (isAdmin) {
return res.status(200).send({
message: 'Access granted'
});
} else {
return res.status(401).send({
message: 'Access denied'
});
}
})
.catch((err) => {
logger.error(err.message);
});
});
๐ This might differ from your code but it should give your the right idea hopefully.
The main issue with your original checkAdmin method is that the SQL call is asynchronous. In your code you don't wait for it to finish, but you instantly return admin which at that point will always be null. And null == false.
Don't think about this too much. You normally don't need to alter it or use it.