Patient Authentication Backend #547

Archna-1 · 2022-01-02T06:57:50Z

Status:

🚧 In development

Description

Authenticates patients using Passport.js utilizing patient id's as usernames and secure, randomly generated node-2fa tokens as passwords. Also includes some structural changes to the project, such as:

Conditional middleware which determines whether to use AWS or Passport for authentication based on whether there is a session
Switches and Routes in AllRoutes instead of AppContent

Fixes #457 #442 #465

Todos

Finish up my commented TODOs to clean up code
Clean up routing if possible
Clean up redirects in patient portal (stretch goal)
Clean up navigation to the patient portal without hard coding it
Standardize route file naming with other components (?)
Change cookie time-out to // null (until the user exits the tab) // Decided on 10 minutes due to shared iPads
Confirm cookie timeout after 1 minute again
Fix patient portal briefly rendering while checking auth status

Need to Address/Verify Before Merging:

Is the current secret for cookies okay?
Are we planning on implementing backend translations? It causes Twilio messages to not be sent in Arabic
How do I handle only dispatch being used in AWS routes?

Screenshots

None at the moment, but you can pull and try it out yourself! You will need to:

Log out of your account as an admin
Add your phone number to a user in the database
Navigate to localhost:3000/patient-2fa/[patient id of chosen user]
Enter the code you receive from Twilio
Attempt to navigate to localhost:3000/patients or localhost:3000/[restricted route]/[patient id of chosen user]

You should not be able to access anything other than the patient login page and patient portal.

FIXED AS OF 1/2: The patient portal will now redirect if you try to directly access it.

…nto patient-2fa-backend

vercel · 2022-01-02T06:57:53Z

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployment, click below or on the icon next to each commit.

🔍 Inspect: https://vercel.com/hack4impact/3dp4me/2AkdFRLEHMJY99J9umPpDjC7Pp4t
✅ Preview: https://3dp4me-git-patient-2fa-backend-hack4impact1.vercel.app

mattwalo32

Nice work, this is an amazing amount of progress

mattwalo32 · 2022-01-25T21:16:30Z

backend/app.js

@@ -24,7 +27,7 @@ const app = express();
 app.use(configureHelment());
 app.use(setResponseHeaders);
 app.use(express.static(path.join(__dirname, '../frontend/build')));
-app.use(cors());
+app.use(cors({ credentials: true, origin: 'http://localhost:3000', methods: ['GET', 'POST'] }));


Do you need the origin property for this to work? If so, then we need to make origin part of the env vars so that the production environment doesn't have localhost as origin

mattwalo32 · 2022-01-25T21:17:10Z

backend/app.js

+const sess = {
+    secret: '3DP4ME',
+    cookie: {
+        domain: 'localhost', path: '/', httpOnly: true, secure: false, maxAge: 150000,


Same issue with domain as with origin ^^

mattwalo32 · 2022-01-25T21:20:12Z

backend/routes/api/authentication.js

+        if (err) { return err; }
+        console.log(req.session);
+        // do i need this line?
+        req.session.save();


Probably don't need this line anymore. I'd try without it

mattwalo32 · 2022-01-25T21:20:40Z

backend/routes/api/authentication.js

+    console.log('nah');
+    req.logIn(req.user, (err) => {
+        if (err) { return err; }
+        console.log(req.session);


Many console.logs that could be removed

mattwalo32 · 2022-01-25T21:24:13Z

backend/routes/api/authentication.js

            );
        }
    }),
 );

+router.get(
+    '/patient-portal/:patientId',


We already have a route for getting a patient by id. It seems like this route would be redundant then. The only difference would be the authentication... I.e. If a volunteer is authenticated, they can view any patient. If a patient is authenticated, they can only view their own data.

So I would just reuse the existing patient endpoint but change the auth middleware on that endpoint so that it allows either type of user to access it.

But now that I'm looking at this more, it seems like you were just using this endpoint for testing right?

mattwalo32 · 2022-01-25T21:33:29Z

frontend/src/Routes/allRoutes.js

@@ -0,0 +1,28 @@
+import React from 'react';


Looks like this is a duplicate file. You have a file named allRoutes and one named AllRoutes and they appear to be the same.

mattwalo32 · 2022-01-25T21:33:53Z

frontend/src/Routes/awsRoutes.js

@@ -0,0 +1,148 @@
+import React, { useContext, useEffect, useState } from 'react';


It seems you also have duplicate AWSRoutes

mattwalo32 · 2022-01-25T21:36:35Z

frontend/src/api/axios-patient-auth.js

+    },
+});
+
+export const send2FAPatientCode = async (_id) => {


I'm a little confused at what this does. It seems like authenticatePatient is the one that actually sends the 2FA code.

Is this the endpoint that requests a 2FA code?

mattwalo32 · 2022-01-25T21:38:41Z

frontend/src/pages/Patient2FALogin/Patient2FALogin.js

@@ -42,7 +61,7 @@ const Patient2FALogin = () => {
                    <button
                        className="two-factor-authentication-button"
                        type="submit"
-                        onClick={() => setIsTokenSent(true)}
+                        onClick={() => onTokenSend()}


You could just replace this with
onClick={onTokenSend}

Same thing with the onChange and onClick below this

mattwalo32 · 2022-01-25T21:39:57Z

frontend/src/pages/PatientPortal/PatientPortal.js

+const PatientPortal = () => {
+    const params = useParams();
+    const { patientId } = params;
+    const [shouldRender, setShouldRender] = useState();


Should probably make the useState default to something, like false

Archna-1 added 13 commits November 24, 2021 18:16

Get auth endpoints working

70cb274

Work on sending token through Whatsapp/Twilio

b405c26

Merge branch 'master' of https://github.com/hack4impact-uiuc/3dp4me i…

b413198

…nto patient-2fa-backend

Connect Twilio to token sending endpoint

0bf7807

Add support for patient phone numbers from database

d25bd54

Connect patient token login to placeholder page

8977d5b

Add constants and change patient-2fa URL

c337f07

Save progress on authentication

1d58410

Get sessions working

c23b05a

Add conditional authentication middleware

21539dc

Finish auth :)

cfb7c1f

Add details back to navbars

8699651

Merge branch 'master' into patient-2fa-backend

94eefa9

Archna-1 marked this pull request as ready for review January 2, 2022 15:07

auto-assign bot requested a review from suewee January 2, 2022 15:07

auto-assign bot assigned ayogik Jan 2, 2022

Redirect unauthenticated and unrecognized patients

3c96c47

vercel bot deployed to Preview January 2, 2022 21:28 View deployment

Check authentication status before rendering

bfffd9e

vercel bot deployed to Preview January 2, 2022 22:09 View deployment

Fix linter errors

994d4d3

vercel bot deployed to Preview January 2, 2022 22:17 View deployment

Clean up pathing and change session timeout

1a82aa8

vercel bot deployed to Preview January 2, 2022 22:38 View deployment

Run yarn format

20aa049

vercel bot deployed to Preview January 6, 2022 07:06 View deployment

Rename routes

35d33e4

vercel bot deployed to Preview January 6, 2022 07:18 View deployment

mattwalo32 reviewed Jan 25, 2022

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Patient Authentication Backend #547

Patient Authentication Backend #547

Archna-1 commented Jan 2, 2022 •

edited

vercel bot commented Jan 2, 2022 •

edited

mattwalo32 left a comment

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

mattwalo32 Jan 25, 2022

		@@ -0,0 +1,148 @@
		import React, { useContext, useEffect, useState } from 'react';

Patient Authentication Backend #547

Are you sure you want to change the base?

Patient Authentication Backend #547

Conversation

Archna-1 commented Jan 2, 2022 • edited

Status:

Description

Todos

Screenshots

vercel bot commented Jan 2, 2022 • edited

mattwalo32 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Archna-1 commented Jan 2, 2022 •

edited

vercel bot commented Jan 2, 2022 •

edited