Port security, CI and stability fixes from new-test-branch onto main

.github/workflows/deploy.yml

@@ -53,6 +53,7 @@ jobs:
           docker run -d \
             --name backend_test \
             -e MONGODB_URI=${{ secrets.MONGODB_URI }} \
+            -e SESSION_SECRET=${{ secrets.SESSION_SECRET }} \
             -e JWT_SECRET_TOKEN=${{ secrets.JWT_SECRET_TOKEN }} \
             -e FRONTEND_URL=${{ secrets.FRONTEND_URL }} \
             -e BACKEND_URL=${{ secrets.BACKEND_URL }} \
@@ -62,5 +63,7 @@ jobs:
           sleep 15
           echo "Checking backend container logs:"
           docker logs backend_test
+          curl --fail http://localhost:8000/ || (echo "Backend container failed to respond!" && docker logs backend_test && exit 1)
+          docker stop backend_test
       - name:  Push Backend Docker image
         run: docker push ${{ secrets.DOCKER_USERNAME }}/backend:latest

.gitignore

@@ -15,6 +15,9 @@
 /build
 frontend/build/
 
+# generated by the tailwind build step
+frontend/src/tailwind.css
+
 # new production logs
 production.log
 

README.md

@@ -67,7 +67,7 @@ cd Student_Database_COSA
   # For Windows
   copy .env.example .env
   ```
-  Now, open the new `.env` file and fill in your actual values.
+  Now, open the new `.env` file and fill in your actual values. `SESSION_SECRET` and `JWT_SECRET_TOKEN` are required — the server refuses to start without them.
 
 - **Seed the database:**
   This next command populates the database with initial necessary data. **You only need to run this once during the initial setup.**
@@ -78,7 +78,7 @@ cd Student_Database_COSA
   ```bash
   node index.js
   ```
-The backend server should now be running on `http://localhost:5000`.Keep this terminal open.
+The backend server should now be running on `http://localhost:8000`.Keep this terminal open.
 
 ### 3. Frontend Setup
 **Open a new, separate terminal window.** This is important, as your backend server needs to keep running in the first terminal.

backend/.env.example

@@ -1,8 +1,8 @@
 MONGODB_URI = mongodb://localhost:27017/cosadatabase
 JWT_SECRET_TOKEN='secret-token'
 FRONTEND_URL=http://localhost:3000
-BACKEND_URL=http://localhost:5000
-PORT=5000
+BACKEND_URL=http://localhost:8000
+PORT=8000
 
 GOOGLE_CLIENT_ID=OAuth_Client_ID_from_google_cloud_console
 GOOGLE_CLIENT_SECRET=OAuth_Client_Secret_from_google_cloud_console

backend/Dockerfile

@@ -6,6 +6,9 @@ RUN apk update && apk upgrade --no-cache
 
 COPY package.json package-lock.json ./
 
+# Puppeteer's Chrome is installed in the runtime stage via apk.
+ENV PUPPETEER_SKIP_DOWNLOAD=true
+
 RUN npm ci
 
 COPY . .
@@ -17,15 +20,20 @@ FROM node:18-alpine
 
 WORKDIR /app
 
-RUN apk update && apk upgrade --no-cache
+RUN apk update && apk upgrade --no-cache \
+    && apk add --no-cache chromium \
+    && rm -rf /var/cache/apk/*
 
 COPY --from=builder /app ./
 
 RUN addgroup -S appgroup && adduser -S appuser -G appgroup && chown -R appuser:appgroup /app
 
 USER appuser
 
-EXPOSE 3000
+ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
+ENV PUPPETEER_NO_SANDBOX=true
+
+EXPOSE 8000
 
 CMD ["node", "index.js"]
 

backend/controllers/achievementController.js

@@ -1,5 +1,6 @@
 const { Achievement } = require("../models/schema");
 const { v4: uuidv4 } = require("uuid");
+const { ROLE_GROUPS } = require("../utils/roles");
 
 // GET unverified achievements by type
 const getUnendorsedAchievements = async (req, res) => {
@@ -94,15 +95,18 @@ const addAchievement = async (req, res) => {
       user_id,
     } = req.body;
 
-    if (!title || !category || !date_achieved || !user_id) {
+    const isAdmin = ROLE_GROUPS.ADMIN.includes(req.user.role);
+    const targetUserId = isAdmin ? user_id : req.user._id;
+
+    if (!title || !category || !date_achieved || !targetUserId) {
       return res.status(400).json({
         message: "Missing required fields",
       });
     }
 
     const achievement = new Achievement({
       achievement_id: uuidv4(),
-      user_id,
+      user_id: targetUserId,
       title,
       description,
       category,

backend/controllers/certificateBatchController.js

@@ -9,7 +9,6 @@ const { findEvent } = require("../services/event.service");
 const { findTemplate } = require("../services/template.service");
 const { getApprovers } = require("../services/user.service");
 const {
-  getOrganization,
   getCoordinatorOrganization,
 } = require("../services/organization.service");
 const { HttpError } = require("../utils/httpError");
@@ -107,7 +106,7 @@ async function createBatch(req, res) {
     }
 
 
-    const newBatch = await CertificateBatch.create({
+    await CertificateBatch.create({
       title,
       eventId: event._id,
       templateId: template._id,
@@ -188,6 +187,12 @@ async function editBatch(req, res) {
       return res.status(404).json({ message: "Batch not found" });
     }
 
+    if (batch.initiatedBy.toString() !== id) {
+      return res.status(403).json({
+        message: "You are not authorized to edit this batch",
+      });
+    }
+
     Object.assign(batch, validation.data);
 
     batch.lifecycleStatus = action;
@@ -271,7 +276,7 @@ async function duplicateBatch(req, res) {
     const array = batch.title.split("(Copy)");
     const count = array.length -1;
     const title = `${array[0]} Copy(${count})`;
-    const newBatch = await CertificateBatch.create({
+    await CertificateBatch.create({
       ...batch.toObject(),
       title: title,
       lifecycleStatus: "Draft",
@@ -539,6 +544,13 @@ async function approveBatch(req, res) {
       };
     }
 
+    // Final (President) approval: generate certificates BEFORE marking the
+    // batch Active/Approved. If generation fails, the batch stays Submitted
+    // so the approval can be retried once the cause is fixed.
+    if (level === 1) {
+      await generateCertificates(batch);
+    }
+
     const updatedBatch = await CertificateBatch.findOneAndUpdate(
       matchQuery,
       update,
@@ -552,17 +564,11 @@ async function approveBatch(req, res) {
       });
     }
 
-    if (level === 1) {
-      // Final (President) approval just happened - generate certificates
-      // exactly once, from the freshly-updated, level===2 document.
-      await generateCertificates(updatedBatch);
-    }
-
     return res.status(200).json({
       message:
         level === 0
           ? "Batch approved by GENSEC. Forwarded to President."
-          : "Batch approved successfully. Certificates are being generated.",
+          : "Batch approved successfully. Certificates generated.",
     });
   } catch (err) {
     if (err instanceof HttpError) {

backend/controllers/eventControllers.js

@@ -215,7 +215,30 @@ exports.deleteEvent = async (req, res) => {
 exports.updateEvent = async (req, res) => {
   try {
     const { eventId } = req.params;
-    const updates = req.body;
+
+    const allowedFields = [
+      "title",
+      "description",
+      "category",
+      "type",
+      "schedule",
+      "registration",
+      "budget",
+      "status",
+    ];
+
+    const updates = {};
+    for (const field of allowedFields) {
+      if (req.body[field] !== undefined) {
+        updates[field] = req.body[field];
+      }
+    }
+
+    if (Object.keys(updates).length === 0) {
+      return res.status(400).json({
+        message: "No editable fields provided",
+      });
+    }
 
     const event = await Event.findByIdAndUpdate(
       eventId,
@@ -241,7 +264,6 @@ exports.updateEvent = async (req, res) => {
 
     return res.status(500).json({
       message: "Server error",
-      error: err.message,
     });
   }
 };
@@ -450,7 +472,7 @@ exports.registerForEvent = async (req, res) => {
 
 
 exports.getEventsByRole = async (req, res) => {
-  const userRole = req.params.userRole;
+  const userRole = req.user.role;
 
   try {
     let query = {};
@@ -465,7 +487,7 @@ exports.getEventsByRole = async (req, res) => {
         break;
 
       case "CLUB_COORDINATOR": {
-        const username = req.query.username;
+        const username = req.user.username;
 
         if (!username) {
           return res.status(400).json({

backend/controllers/feedbackController.js

@@ -15,13 +15,12 @@ exports.addFeedback = async (req, res) => {
       type,
       target_type,
       target_id,
-      feedback_by,
       rating,
       comments,
       is_anonymous,
     } = req.body;
 
-    if (!type || !target_type || !target_id || !feedback_by) {
+    if (!type || !target_type || !target_id) {
       return res.status(400).json({
         message: "Missing required fields",
       });
@@ -47,7 +46,7 @@ exports.addFeedback = async (req, res) => {
       type,
       target_type,
       target_id,
-      feedback_by,
+      feedback_by: req.user._id,
       rating,
       comments,
       is_anonymous:
@@ -225,6 +224,11 @@ exports.viewFeedback = async (req, res) => {
           }
 
           const fbObj = fb.toObject();
+
+          if (fbObj.is_anonymous) {
+            fbObj.feedback_by = null;
+          }
+
           fbObj.target_data = targetData;
 
           return fbObj;

backend/controllers/profileController.js

@@ -11,12 +11,7 @@ cloudinary.config({
 
 exports.updateProfilePhoto = async (req, res) => {
     try {
-        const { ID_No } = req.body;
-        if (!ID_No) {
-            return res.status(400).json({ error: "ID_No is required" });
-        }
-
-        const user = await User.findOne({ user_id: ID_No });
+        const user = await User.findById(req.user.id);
         if (!user) {
             return res.status(404).json({ error: "User not found" });
         }
@@ -69,12 +64,7 @@ exports.updateProfilePhoto = async (req, res) => {
 // Delete profile photo (reset to default)
 exports.deleteProfilePhoto = async (req, res) => {
     try {
-        const { ID_No } = req.query; // Get ID_No from frontend for DELETE
-        if (!ID_No) {
-            return res.status(400).json({ error: "ID_No is required" });
-        }
-
-        const user = await User.findOne({ user_id: ID_No }); // Capital User
+        const user = await User.findById(req.user.id);
         if (!user) {
             return res.status(404).json({ error: "User not found" });
         }
@@ -116,6 +106,13 @@ exports.updateStudentProfile = async (req, res) => {
                 .json({ success: false, message: "Student not found" });
         }
 
+        if (user._id.toString() !== req.user.id.toString()) {
+            return res.status(403).json({
+                success: false,
+                message: "Not authorized to update this profile",
+            });
+        }
+
         // ---------- PERSONAL INFO ----------
         if (updatedDetails.personal_info) {
             const {
@@ -125,7 +122,6 @@ exports.updateStudentProfile = async (req, res) => {
                 gender,
                 date_of_birth,
                 profilePic,
-                cloudinaryUrl,
             } = updatedDetails.personal_info;
 
             if (name) {
@@ -146,9 +142,6 @@ exports.updateStudentProfile = async (req, res) => {
             if (profilePic) {
                 user.personal_info.profilePic = profilePic;
             }
-            if (cloudinaryUrl) {
-                user.personal_info.cloudinaryUrl = cloudinaryUrl;
-            }
         }
 
         // ---------- ACADEMIC INFO ----------

backend/controllers/skillController.js

@@ -1,5 +1,6 @@
 const { UserSkill, Skill } = require("../models/schema");
 const { v4: uuidv4 } = require("uuid");
+const { ROLE_GROUPS } = require("../utils/roles");
 
 // GET unendorsed user skills for a particular skill type
 exports.getUnendorsedUserSkills = async (req, res) => {
@@ -176,8 +177,11 @@ exports.createUserSkill = async (req, res) => {
     try {
         const { user_id, skill_id, proficiency_level, position_id } = req.body;
 
+        const isAdmin = ROLE_GROUPS.ADMIN.includes(req.user.role);
+        const targetUserId = isAdmin ? user_id : req.user._id;
+
         const newUserSkill = new UserSkill({
-            user_id,
+            user_id: targetUserId,
             skill_id,
             proficiency_level,
             position_id: position_id || null,