feat(client): show real data

server/src/messages/Login.ts

@@ -8,6 +8,6 @@ export class LoginRequest{
 export class LoginResponse{
     constructor(
         public user: Account,
-        public ownedBusinesses: Account[],
+        public ownedAccounts: Account[],
     ){}
 }

server/src/messages/Send.ts

@@ -1,5 +1,6 @@
 export class SendRequest{
     constructor(
+        public senderID: string,
         public recipientID: string,
         public amount: number,
         public reference: string

server/src/messages/Transactions.ts

@@ -2,6 +2,7 @@ import Transaction from "../model/transaction";
 
 export class TransactionsRequest{
     constructor(
+        public forId: string,
         public offset = 0,
         public count = 50,
     ){}

server/src/model/user.ts

@@ -1,6 +1,8 @@
 import { Table, Column, Model, DataType, Scopes, DefaultScope, DeletedAt, BelongsToMany, ForeignKey} from 'sequelize-typescript';
 
+@Table
 @DefaultScope(() => ({
+  //FIXME getting account still includes password
   attributes:{ exclude: ['password']}
 }))
 @Scopes(() => ({
@@ -8,38 +10,57 @@ import { Table, Column, Model, DataType, Scopes, DefaultScope, DeletedAt, Belong
     attributes: {include: ['password']}
   }
 }))
-@Table
 export default class Account extends Model{
 
-    @Column({primaryKey: true, unique: true, allowNull: false})
-    declare id: string;
+  @Column({primaryKey: true, unique: true, allowNull: false})
+  declare id: string;
 
-    @Column
-    declare isBusiness: boolean;
+  @Column
+  declare isBusiness: boolean;
 
-    @Column
-    declare displayName: string;
+  @Column
+  declare displayName: string;
 
-    @Column(DataType.DECIMAL(20,2))
-    declare balance: number;
+  @Column(DataType.DECIMAL(20,2))
+  declare balance: number;
 
-    @Column
-    declare password: string;
-    
-    @DeletedAt
-    declare deletedAt: Date | null;
-    
+  @Column
+  declare password: string;
+  
+  @DeletedAt
+  declare deletedAt: Date | null;
+  
+  @BelongsToMany(() => Account, () => BusinessOwnership, 'ownerAccountId', 'ownedAccountId')
+  declare ownedBusinesses: Account[];
+
+  @BelongsToMany(() => Account, () => BusinessOwnership, 'ownedAccountId', 'ownerAccountId')
+  declare owners: Account[];
+  
+  override toJSON() {
+    const values = { ...this.get() };
+    delete values.password;
+    return values;
+  }
 }
+
 @Table
 export class BusinessOwnership extends Model {
   @ForeignKey(() => Account)
   @Column
-  ownerAccountId!: number;
+  declare ownerAccountId: string;
 
   @ForeignKey(() => Account)
   @Column
-  ownedAccountId!: number;
+  declare ownedAccountId: string;
 
   @DeletedAt
   declare deletedAt: Date | null;
+}
+
+export async function getOwnedAccounts(user: Account){
+    let q = await Account.findByPk(user.id, {
+      include: ['ownedBusinesses'],
+    });
+    let ownedAccounts = q?.ownedBusinesses;
+    return ownedAccounts ?? [];
 }

server/src/routes/auth.ts

@@ -1,10 +1,10 @@
 import { compare } from 'bcrypt';
 import express from 'express';
 import { logger } from '../util/logging';
-import Account from '../model/user';
+import Account, { getOwnedAccounts } from '../model/user';
 import { Scope } from '../util/db';
 import { getJWT, requireAuth } from '../util/auth';
-import { LoginRequest } from '../messages/Login';
+import { LoginRequest, LoginResponse } from '../messages/Login';
 import { GenericMessage as Msg } from '../messages/Message';
 
 const router = express.Router();
@@ -25,7 +25,7 @@ router.post('/login', async (req, res) => {
       sameSite: 'strict', // CSRF protection
       maxAge: 86400000,  // 1 day
     });
-    res.json(new Msg('Logged in successfully'));
+    res.json(new LoginResponse(user, await getOwnedAccounts(user)));
   }catch (err) {
     logger.error('Failed to authenticate:', err);
     res.status(500).json(new Msg('Failed to authenticate'));

server/src/routes/send.ts

@@ -1,7 +1,7 @@
 import express  from 'express';
 import { logger } from '../util/logging';
 import { requireAuth } from '../util/auth';
-import Account from '../model/user';
+import Account, { BusinessOwnership, getOwnedAccounts } from '../model/user';
 import { db } from '../util/db';
 import Transaction from '../model/transaction';
 import { SendRequest, SendResponse} from '../messages/Send';
@@ -12,15 +12,25 @@ const router = express.Router();
 
 router.post('/', requireAuth, async (req, res) => {
   try {
-    const sender = res.locals.user as Account;
+    const user = res.locals.user as Account;
     const data : SendRequest = req.body;
-    const recipient = await Account.findOne({where: {id: data.recipientID}})
     if ( Number(data.amount) <= 0) {
       return res.status(400).json(new Err('Invalid transfer amount'));
     }
+    const recipient = await Account.findOne({where: {id: data.recipientID}})
     if (!recipient) {
       return res.status(404).json(new Err('Recipient not found' ));
     }
+    const sender = await Account.findOne({where: {id: data.senderID}})
+    if (!sender) {
+      return res.status(404).json(new Err('Sender not found' ));
+    }
+    let ownsAccount = (await getOwnedAccounts(user))?.some(
+      business => business.id == data.senderID
+    );
+    if(!(user.equals(sender) || ownsAccount )){
+      return res.status(403).json(new Err('Unauthorized sender'));
+    }
     if (Number(sender.balance) < Number(data.amount)){
       logger.debug(`Insufficient balance: ${sender.balance} < ${data.amount}`)
       return res.status(402).json(new Err('Insufficient balance'))