From ec70fe1b80933d84a43d0e6f5e71ce3183eaf4eb Mon Sep 17 00:00:00 2001
From: Kerim Hudson <code@kerim.sh>
Date: Thu, 10 Jun 2021 12:52:43 +0100
Subject: [PATCH] Move the password validation server side, and remove dotenv
 from frontend

---
 controllers/authentication.js           | 10 ++++++++++
 frontend/src/screen/Home/AdminLogin.jsx | 14 ++++++++++----
 routes/authentication.js                |  7 +++++++
 server.js                               |  3 ++-
 4 files changed, 29 insertions(+), 5 deletions(-)
 create mode 100644 controllers/authentication.js
 create mode 100644 routes/authentication.js

diff --git a/controllers/authentication.js b/controllers/authentication.js
new file mode 100644
index 0000000..ba32e08
--- /dev/null
+++ b/controllers/authentication.js
@@ -0,0 +1,10 @@
+const PASSWORD = process.env.PASSWORD;
+
+exports.validatePassword = (req, res) => {
+  const { password } = req.body;
+  if (password === PASSWORD) {
+    res.status(200).json({ success: true });
+  } else {
+    res.status(401).json({ success: false });
+  }
+};
diff --git a/frontend/src/screen/Home/AdminLogin.jsx b/frontend/src/screen/Home/AdminLogin.jsx
index 30a478a..6d1bf0b 100644
--- a/frontend/src/screen/Home/AdminLogin.jsx
+++ b/frontend/src/screen/Home/AdminLogin.jsx
@@ -1,14 +1,20 @@
 import React, { useState } from "react";
 import users from "../../data/users.json";
-import dotenv from "dotenv";
+import axios from "axios";
 
 import "./AdminLogin.scss";
 
 const AdminLogin = ({ closeHandler, showAlert }) => {
   const [adminPassword, setAdminPassword] = useState("");
-  dotenv.config();
-  const validateAdminPasswordInput = () => {
-    if (adminPassword.trim() === process.env.REACT_APP_Password) {
+
+  const validateAdminPasswordInput = async () => {
+    const {
+      data: { success },
+    } = await axios.post("/api/v1/authentication/login", {
+      password: adminPassword.trim(),
+    });
+
+    if (success) {
       closeHandler();
       showAlert("success", "The security code has been verified successfully.");
       setTimeout(() => {
diff --git a/routes/authentication.js b/routes/authentication.js
new file mode 100644
index 0000000..e891cf3
--- /dev/null
+++ b/routes/authentication.js
@@ -0,0 +1,7 @@
+const express = require("express");
+const router = express.Router();
+const { validatePassword } = require("../controllers/authentication");
+
+router.route("/login").post(validatePassword);
+
+module.exports = router;
diff --git a/server.js b/server.js
index 23d7f6e..c979461 100644
--- a/server.js
+++ b/server.js
@@ -12,7 +12,8 @@ app.use(express.json());
 
 app.use("/api/v1/classes", require("./routes/classes"));
 app.use("/api/v1/bookings", require("./routes/bookings"));
-app.use("/api/v1/courses", require("./routes/courseCalendar")); 
+app.use("/api/v1/courses", require("./routes/courseCalendar"));
+app.use("/api/v1/authentication", require("./routes/authentication"));
 
 if (process.env.NODE_ENV === "production") {
   app.use(express.static("frontend/build"));