unlink calendar with password

src/controllers/calendarController.ts

@@ -1,10 +1,11 @@
 import { Request, Response } from "express";
 import logger from "../logger/logger";
 import Store from "../models/store";
-import { getUserSession } from "../utils/utils";
+import { decodeBase64, getUserSession, matchPassword } from "../utils/utils";
 import User from "../models/user";
 import UserGoogleTokens from "../models/userGoogleTokens";
 import axios from "axios";
+import { isPasswordValid } from "../validator/validator";
 
 // this request is needed to get the store id after the user has connected his calendar to redirect him back to the calendar page
 export async function GetStoreId(req: Request, res: Response) {
@@ -225,9 +226,7 @@ export async function UpdateStoreCalendarSettings(req: Request, res: Response) {
         store_id: store.store_id,
       },
     })
-      .then(() => {
-        res.status(200).send({ msg: "success" });
-      })
+      .then(() => res.status(200).send({ msg: "success" }))
       .catch((err) => {
         logger.error(err);
         res.status(500).send({ err: "invalid request" });
@@ -240,6 +239,14 @@ export async function UpdateStoreCalendarSettings(req: Request, res: Response) {
 
 export async function UnlinkGoogleCalendar(req: Request, res: Response) {
   try {
+    const { password, deleteCalendars } = req.body;
+
+    // validate request
+
+    if (!password || !deleteCalendars) {
+      return res.status(400).send({ err: "invalid request" });
+    }
+
     const userSession = await getUserSession(req);
 
     if (!userSession) {
@@ -258,19 +265,47 @@ export async function UnlinkGoogleCalendar(req: Request, res: Response) {
       return res.status(401).send({ err: "unauthorized" });
     }
 
-    console.log("userSession.user_id", userSession.user_id);
+    // decode password
+
+    const decodedPassword = decodeBase64(password);
+
+    if (!isPasswordValid(decodedPassword)) {
+      logger.debug("Password is not valid");
+      return res.status(400).send({ err: "invalid request" });
+    }
+
+    // get user to compare password
+
+    const user = await User.findOne({
+      where: {
+        user_id: userSession.user_id,
+      },
+      attributes: ["password"],
+    });
+
+    if (!user) {
+      logger.debug("User not found");
+      return res.status(400).send({ err: "invalid request" });
+    }
+
+    // compare password
+
+    const match = await matchPassword(decodedPassword, user.password);
+
+    if (!match) {
+      logger.debug("Password is not valid");
+      return res.status(400).send({ err: "invalid request" });
+    }
+
+    // request to termin planner to remove google account
 
     axios
       .post(`${process.env.TERMIN_PLANNER_URL}/removeGoogleAccount` as string, {
         userId: userSession.user_id,
-        deleteCalendars: false,
+        deleteCalendars: deleteCalendars,
         pass: process.env.TERMIN_PLANNER_AUTHORIZATION_PASSWORD as string,
       })
-      .then((response) => {
-        logger.info("response %s", response.data);
-
-        res.status(200).send({ msg: "success" });
-      })
+      .then(() => res.status(200).send({ msg: "success" }))
       .catch((err) => {
         logger.info("err %s", err);
 

src/routes/calendarRoutes.ts

@@ -11,6 +11,7 @@ router.get(
   "/auth/google",
   passport.authenticate("google", {
     accessType: "offline",
+
     //session: false,
     scope: [
       "https://www.googleapis.com/auth/calendar.app.created",