Merge pull request #30 from kamath/ani/cla-34-certain-routes-should-only-be-accessible-by-admin-users

Ani/cla 34 certain routes should only be accessible by admin users

Author: kamath

apps/backend/package.json

@@ -8,7 +8,7 @@
     "start": "bun run src/index.ts",
     "lint": "eslint . --max-warnings 0 --fix",
     "check-types": "tsc --noEmit",
-	"build": "tsc --noEmit"
+    "build": "tsc --noEmit"
   },
   "exports": {
     ".": "./src/index.ts",
@@ -20,6 +20,7 @@
     "@hono/zod-openapi": "^0.18.0",
     "@posthog/ai": "^7.2.0",
     "@repo/api-types": "*",
+    "@workos-inc/node": "^7.75.1",
     "ai": "^5.0.104",
     "hono": "^4.7.0",
     "posthog-node": "^5.14.1",

apps/backend/src/client-types.ts

@@ -8,5 +8,5 @@ import type { OpenAPIHono } from "@hono/zod-openapi";
 // This provides type hints without needing to resolve the actual route implementations
 export type AppType = OpenAPIHono<{
   Bindings: Record<string, unknown>;
-  Variables: { userId: string };
+  Variables: { userId: string; isAdmin: boolean };
 }>;

apps/backend/src/index.ts

@@ -42,6 +42,7 @@ const api = new OpenAPIHono<{
   Bindings: Env;
   Variables: {
     userId: string;
+    isAdmin: boolean;
     db: Database;
   };
 }>();

apps/backend/src/middleware/auth.ts

@@ -1,6 +1,7 @@
 import { createMiddleware } from "hono/factory";
 import { HTTPException } from "hono/http-exception";
 import { decryptUserId } from "@/utils/auth";
+import { WorkOS } from "@workos-inc/node";
 
 export const apiKeyAuth = createMiddleware(async (c, next) => {
   const apiKey = c.req.header("X-API-Key");
@@ -13,8 +14,15 @@ export const apiKeyAuth = createMiddleware(async (c, next) => {
 
   try {
     const decryptedUserId = await decryptUserId(apiKey, c.env);
+    const workos = new WorkOS(c.env.WORKOS_API_KEY);
+
+    const user = await workos.userManagement.getUser(decryptedUserId);
+
+    console.log("User:", JSON.stringify(user, null, 2));
+
     console.log("Decrypted user ID:", decryptedUserId);
     c.set("userId", decryptedUserId);
+    c.set("isAdmin", user.metadata?.role === "superduperadmin");
   } catch (error) {
     console.error("Failed to decrypt user ID:", error);
     throw new HTTPException(403, {
@@ -24,3 +32,16 @@ export const apiKeyAuth = createMiddleware(async (c, next) => {
 
   await next();
 });
+
+export const requireAdmin = createMiddleware(async (c, next) => {
+  const isAdmin = c.get("isAdmin");
+
+  if (!isAdmin) {
+    throw new HTTPException(403, {
+      message:
+        "Admin access required. This endpoint is only accessible to administrators.",
+    });
+  }
+
+  await next();
+});

apps/backend/src/routes/problems.ts

@@ -1,5 +1,6 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import type { Context } from "hono";
+import { HTTPException } from "hono/http-exception";
 import {
   generateProblemText,
   getProblemText,
@@ -67,6 +68,7 @@ const problems = new OpenAPIHono<{
   Bindings: Env;
   Variables: {
     userId: string;
+    isAdmin: boolean;
     db: Database;
   };
 }>();
@@ -123,7 +125,10 @@ async function shouldReturnIdempotentError(
 
 // Helper to start workflow if autoGenerate is enabled (for problem creation)
 async function startWorkflowIfAuto(
-  c: Context<{ Bindings: Env; Variables: { userId: string; db: Database } }>,
+  c: Context<{
+    Bindings: Env;
+    Variables: { userId: string; isAdmin: boolean; db: Database };
+  }>,
   problemId: string,
   model?: string,
   autoGenerate: boolean = true,
@@ -158,7 +163,10 @@ async function startWorkflowIfAuto(
 
 // Helper to start workflow from a specific step if enqueueNextStep is enabled
 async function startWorkflowFromStepIfEnabled(
-  c: Context<{ Bindings: Env; Variables: { userId: string; db: Database } }>,
+  c: Context<{
+    Bindings: Env;
+    Variables: { userId: string; isAdmin: boolean; db: Database };
+  }>,
   problemId: string,
   currentStep: GenerationStep,
   model?: string,
@@ -718,6 +726,15 @@ problems.openapi(generateInputCodeRoute, async (c) => {
 problems.openapi(getInputCodeRoute, async (c) => {
   const db = c.get("db");
   const { problemId } = c.req.valid("param");
+  const isAdmin = c.get("isAdmin");
+
+  // Check admin access
+  if (!isAdmin) {
+    throw new HTTPException(403, {
+      message:
+        "Admin access required. This endpoint is only accessible to administrators.",
+    });
+  }
 
   // Validate prerequisite: test cases must exist
   const problem = await getProblem(problemId, db);
@@ -814,6 +831,7 @@ problems.openapi(generateInputsRoute, async (c) => {
 problems.openapi(getInputsRoute, async (c) => {
   const db = c.get("db");
   const { problemId } = c.req.valid("param");
+  const isAdmin = c.get("isAdmin");
 
   // Validate prerequisite: all test cases must have inputCode
   const problem = await getProblem(problemId, db);
@@ -835,7 +853,20 @@ problems.openapi(getInputsRoute, async (c) => {
     );
   }
 
-  const result = await getTestCaseInputs(problemId, db);
+  const allInputs = await getTestCaseInputs(problemId, db);
+
+  // If admin, return all inputs; if not admin, only return inputs for sample test cases
+  let result: unknown[];
+  if (isAdmin) {
+    result = allInputs;
+  } else {
+    // Filter to only include inputs for sample test cases
+    result = problem.testCases
+      .filter((tc) => tc.isSampleCase)
+      .map((tc) => tc.input)
+      .filter((input) => input !== null && input !== undefined);
+  }
+
   return c.json({ success: true as const, data: result }, 200);
 });
 
@@ -947,6 +978,15 @@ problems.openapi(generateSolutionRoute, async (c) => {
 problems.openapi(getSolutionRoute, async (c) => {
   const db = c.get("db");
   const { problemId } = c.req.valid("param");
+  const isAdmin = c.get("isAdmin");
+
+  // Check admin access
+  if (!isAdmin) {
+    throw new HTTPException(403, {
+      message:
+        "Admin access required. This endpoint is only accessible to administrators.",
+    });
+  }
 
   // Validate prerequisite: all test cases must have input field populated
   const problem = await getProblem(problemId, db);
@@ -1085,6 +1125,15 @@ problems.openapi(generateOutputsRoute, async (c) => {
 problems.openapi(getOutputsRoute, async (c) => {
   const db = c.get("db");
   const { problemId } = c.req.valid("param");
+  const isAdmin = c.get("isAdmin");
+
+  // Check admin access
+  if (!isAdmin) {
+    throw new HTTPException(403, {
+      message:
+        "Admin access required. This endpoint is only accessible to administrators.",
+    });
+  }
 
   // Validate prerequisite: solution must exist
   const problem = await getProblem(problemId, db);