CSE 341: Web Services

W04 Assignment: Authentication and Authorization

Overview

This week, your team will add authentication-related behavior to the Kizuna Rail project. Authentication changes need careful coordination because they affect routing, environment variables, protected data, frontend behavior, and deployment settings.

Assignment Requirements

Feature Sets

Each person must complete one feature set. The feature sets are ordered from most critical to least critical. A five-person team should complete all five feature sets. If your team has fewer than five people, complete the first feature sets in order. Assign and complete Feature Set 1 first because the other feature sets depend on it.

Feature Set 1: Core Authentication

For this feature set you will implement the basic authentication functionality for the application.

Complete this first

All other feature sets this week depend on this functionality, so the person who chooses this work should complete it as quickly as possible.

Even though code reviews will not be submitted to Canvas until the start of next week, because the rest of the work this week depends on this functionality, your team should review and merge this feature set as soon as possible.

Follow the process presented in the Session Authentication Middleware learning activity. In particular, you should complete the following tasks:

  1. Add a Mongoose schema for users and roles. Users should contain a display name, username, email, password hash, and role.
  2. Update the db import scripts to add the standard roles to the database. (And run the script to ensure they are present for your team.)
  3. Create new register and login pages.
  4. Add the necessary functionality so users can register, log in, and log out, and the logged-in user's information and role are stored in the session.
  5. Create middleware functions to check for authentication and roles for both pages and APIs as follows:
    • requireApiLogin(): Return JSON with a 401 error if the user is not authenticated.
    • requirePageLogin(): Redirect to the login page if the user is not authenticated.
    • requireApiRole(role): Return JSON with a 401 error if the user is not authenticated or a 403 error if the user does not have the required role.
    • requirePageRole(role): Redirect to the login page if the user is not authenticated or to a 403 error page if the user does not have the required role.
  6. Create a new EJS page for an Admin Dashboard. It should require the user to be signed in and have the admin role. For now the page can simply say, "Welcome to the Admin Dashboard".

Feature Set 2: User Dashboard and Navigation

For this feature set, you will add a new user dashboard and additional navigation links throughout the application to improve user experience and accessibility.

  1. Create a new dashboard page for a standard user that shows the following:
    • Welcome message with the user's display name.
    • List of all bookings where their email matches one of the passengers. This list should be hydrated dynamically through a client-side JavaScript call to the API.
    • Link to the booking admin page.
    • Link to the user admin page.
  2. Update the header to include links to register and login. These links should only be visible to users who are not currently signed in.
  3. Update the header to include a link to logout. This link should only be visible to users who are currently signed in.
  4. Update the header to include a link to the dashboard. This link should only be visible to users who are currently signed in. If the user is an admin, the link should point to the admin dashboard. Otherwise, it should point to the standard user dashboard.
  5. Update the login process so that admin users are automatically redirected to the admin dashboard after logging in. All other users should be redirected to the standard user dashboard.

Feature Set 3: Protected User Admin Page

For this feature set, you will create a new user admin page that requires authentication and provides the ability to update and delete users.

  1. Create a new user admin page that requires authentication.
  2. If the user is not authenticated, redirect them to the login page.
  3. If the user is authenticated and has the admin role, they should see all users in the system.
  4. If the user is authenticated but does not have the admin role, they should see their own user information.
  5. The list of users should be added dynamically through a client-side JavaScript call to the API.
  6. Add to this page the ability to update and delete users through the API.
    • After updating or deleting a user, the list should be updated (without requiring a page refresh) to show the updated information.
    • You should create the model, controller, and route functions for the update and delete operations.
    • Make sure the routes are properly secured and only allow authorized users to perform these actions. (Any user can update or delete their own information. Admin users can update or delete any user.)
  7. Update the admin dashboard to include a link to the protected user admin page.

Feature Set 4: Protected Booking Admin Page

For this feature set, you will update the booking admin page to require authentication and provide the ability to update and delete bookings.

  1. Update the booking admin page to require authentication.
  2. If the user is not authenticated, redirect them to the login page.
  3. If the user is authenticated and has the admin role, they should see all bookings in the system.
  4. If the user is authenticated but does not have the admin role, they should see all bookings where their email address matches one of the passengers.
  5. The list of bookings should be added dynamically through a client-side JavaScript call to the API. (This should have been completed in the previous week.)
  6. Add to this page the ability to update and delete bookings through the API.
    • After updating or deleting a booking, the list should be updated (without requiring a page refresh) to show the updated information.
    • You should create the model, controller, and route functions for the update and delete operations.
    • Make sure the routes are properly secured and only allow authorized users to perform these actions. (Any user can update or delete bookings where they are a passenger. Admin users can update or delete any booking.)
  7. Update the admin dashboard to include a link to the protected booking admin page.

Feature Set 5: Protected Trip Admin Page

For this feature set, you will create a new trip admin page that requires the admin role and provides the ability to update and delete trips.

  1. Implement a new trip admin page that requires authentication.
  2. If the user is not authenticated, redirect them to the login page.
  3. If the user does not have the admin role, they should be redirected to a 403 error page.
  4. If the user is authenticated and has the admin role, they should see all trips in the system.
  5. The list of trips should be added dynamically through a client-side JavaScript call to the API. (This should have been completed in the previous week.)
  6. Add to this page the ability to update and delete trips through the API.
    • After updating or deleting a trip, the list should be updated (without requiring a page refresh) to show the updated information.
    • You should create the model, controller, and route functions for the update and delete operations.
    • Make sure the routes are properly secured and only allow admin users to perform these actions.
  7. When editing a trip, the user should be able to select new stations or new schedules from existing options, but you do not need to implement the creation of new stations or schedules.
  8. Update the admin dashboard to include a link to the protected trip admin page.

Workflow

Select and coordinate feature sets

  1. Complete the Week 04 Team Activity.
  2. Make sure every required feature set has an owner.
  3. Ensure Feature Set 1: Core Authentication is assigned and completed first because the other feature sets depend on it.
  4. Post the feature-set owners and dependencies in your Microsoft Teams channel so everyone knows who is responsible for each piece of work.

Develop a spec for your feature set

Write a detailed spec before coding. You may use one spec for the whole feature set or separate specs for its smaller pieces, but the spec must be detailed enough for a teammate to understand and review the planned work.

Create GitHub issues

Create at least one GitHub issue for your feature set. Include the relevant information from your spec in the issue description. If the feature set has independent pieces, create separate issues so each pull request has a clear and reviewable purpose.

Implement the feature set

Use AI to help

You are encouraged to use AI to help write code for your feature set. Work through files and decisions individually rather than asking AI to change the entire project at once. You need to understand the code you contribute, and AI output still needs to be checked against the assignment requirements and your team's existing patterns.

Follow these steps for each issue in your feature set:

  1. Create a branch for the issue.
  2. Implement the work.
  3. Test the change locally, including signed-out, signed-in, and unauthorized behavior when it applies.
  4. Run the ESLint check and correct any reported errors before creating the pull request.
  5. Create a walk-through video that shows the feature working locally, explains the key code, and describes at least one technical decision you made.
  6. Open a pull request that connects to the GitHub issue, summarizes the changes, includes verified test-plan steps, and links to the walk-through video.
  7. Post in your Microsoft Teams channel that the pull request is ready for review.
  8. Repeat for any additional issues in your feature set.

Pull requests are required

Each assigned feature set must be completed through at least one pull request. Create additional pull requests when they make the work safer and easier to review. Do not push code directly to main.

Prepare for code review

Your teammates will review these pull requests as they become available and during the next week. Make every pull request ready for review before the end of this assignment.

Complete the reflection

  1. Download the Week 04 reflection template.
  2. Answer the questions in your own words.
  3. Upload the completed reflection document to Canvas.

Deliverables Checklist

Other Links: