Add environment variable that enables write operations, default is disabled unless in dev

.anon.env

@@ -5,13 +5,18 @@ USER_CREATION_SECRET: abcdefg
 NOWDB_BACKEND_PORT: 4000
 LOGIN_VALID_MINUTES: 120
 BACKEND_MODE: dev
+
+MARIADB_USER: now_test
 MARIADB_HOST: nowdb-db-anon
 MARIADB_ROOT_PASSWORD: admin
-MARIADB_PORT: 3306
 MARIADB_PASSWORD: mariadb_password
-NOW_DB_NAME: now_anon
+MARIADB_PORT: 3306
-LOG_DB_NAME: now_log_anon
-COORDINATOR: IZ
 
+NOW_DB_NAME: now_test
+LOG_DB_NAME: now_log_test
+
+COORDINATOR: TEST-SU
+
+ENABLE_WRITE: true
 RUNNING_ENV: dev
 VITE_RUNNING_ENV: dev

backend/src/index.ts

@@ -15,22 +15,27 @@ import userRouter from './routes/user'
 import { responseLogger } from './middlewares/requestLogger'
 import compression from 'compression'
 import { logger } from './utils/logger'
-import { PORT, RUNNING_ENV } from './utils/config'
+import { ENABLE_WRITE, PORT, RUNNING_ENV } from './utils/config'
 import { tokenExtractor, userExtractor } from './middlewares/authenticator'
 import { errorHandler } from './middlewares/errorHandler'
 import { createTestUsers } from './services/user'
 import { testDbConnection } from './utils/db'
 import { requireOneOf } from './middlewares/authorizer'
 import { Role } from './../../frontend/src/types'
+import { blockWriteRequests } from './middlewares/misc'
 
 const app = express()
 
 app.use(express.json({ limit: '50mb' }))
 app.use(cors())
 app.use(compression())
+app.use(responseLogger)
+
+if (!ENABLE_WRITE && RUNNING_ENV !== 'dev') {
+  app.use(blockWriteRequests)
+}
 app.use(tokenExtractor)
 app.use(userExtractor)
-app.use(responseLogger)
 
 app.use('/user', userRouter)
 app.use('/locality', localityRouter)

backend/src/middlewares/misc.ts

@@ -0,0 +1,11 @@
+import { Middleware } from '../types'
+
+/* Disables all write routes except the ones excluded by "allowedRoutes" */
+export const blockWriteRequests: Middleware = (req, res, next) => {
+  const allowedRoutes = ['/user/login']
+  const writeMethods = ['POST', 'PUT', 'PATCH', 'DELETE']
+  if (writeMethods.includes(req.method) && !allowedRoutes.includes(req.path)) {
+    return res.status(403).send()
+  }
+  return next()
+}

backend/src/routes/locality.ts

@@ -30,7 +30,7 @@ router.put(
     if (validationErrors.length > 0) {
       return res.status(400).send({ validationErrors })
     }
-    const result = await write(editedLocality, 'now_loc', { authorizer: 'IZ', userName: 'testuser' })
+    const result = await write(editedLocality, 'now_loc', { authorizer: 'TEST-SU', userName: 'testuser' })
     return res.status(200).send(result ? { result: result } : { error: 'error' })
   }
 )

backend/src/utils/config.ts

@@ -15,6 +15,9 @@ const allowedRunningEnvs = ['dev', 'staging', 'prod'] as const
 export const RUNNING_ENV = process.env.RUNNING_ENV as (typeof allowedRunningEnvs)[number]
 if (!allowedRunningEnvs.includes(RUNNING_ENV)) throw new Error('Invalid RUNNING_ENV')
 
+// Enable write operations. If this is not set to 'true', all write (create, update, delete) operations except for allowed ones (like user/login) are disabled.
+export const ENABLE_WRITE = process.env.ENABLE_WRITE === 'true'
+
 export const DB_CONNECTION_LIMIT = (process.env.DB_CONNECTION_LIMIT as string) ?? '10'
 export const NOW_DB_NAME = process.env.NOW_DB_NAME as string
 export const LOG_DB_NAME = process.env.LOG_DB_NAME as string

data/restore_and_create_user.sql

@@ -2,6 +2,7 @@
 DROP DATABASE IF EXISTS now_test; CREATE DATABASE now_test CHARACTER SET latin1;
 DROP DATABASE IF EXISTS now_log_test; CREATE DATABASE now_log_test CHARACTER SET latin1;
 SET names 'latin1';
+
 USE now_test
 SOURCE /docker-entrypoint-initdb.d/sqlfiles/now_test.sql
 USE now_log_test
@@ -12,3 +13,4 @@ SOURCE /docker-entrypoint-initdb.d/sqlfiles/now_view.sql
 CREATE USER 'now_test'@'localhost' IDENTIFIED BY 'mariadb_password';
 GRANT SELECT, INSERT, UPDATE ON `now_log_test`.* TO 'now_test'@'%';
 GRANT SELECT, INSERT, UPDATE, DELETE ON `now_test`.* TO 'now_test'@'%';
+

test_data/restore_and_create_user.sql

@@ -3,13 +3,12 @@ DROP DATABASE IF EXISTS now_test; CREATE DATABASE now_test CHARACTER SET latin1;
 DROP DATABASE IF EXISTS now_log_test; CREATE DATABASE now_log_test CHARACTER SET latin1;
 SET names 'latin1';
 
-CREATE USER 'now_test'@'%' IDENTIFIED BY 'mariadb_password';
-
-GRANT SELECT, INSERT, UPDATE, DELETE ON `now_test`.* TO 'now_test'@'%';
-GRANT SELECT, INSERT, UPDATE ON `now_log_test`.* TO 'now_test'@'%';
-
 USE now_test
 SOURCE /docker-entrypoint-initdb.d/sqlfiles/now_anon.sql
 USE now_log_test
 SOURCE /docker-entrypoint-initdb.d/sqlfiles/now_log_anon.sql
 USE now_test
+
+CREATE USER 'now_test'@'localhost' IDENTIFIED BY 'mariadb_password';
+GRANT SELECT, INSERT, UPDATE ON `now_log_test`.* TO 'now_test'@'%';
+GRANT SELECT, INSERT, UPDATE, DELETE ON `now_test`.* TO 'now_test'@'%';