implement read-access against token, mod default

Could see an endpoint changing the global server variable, `defaultRoles` as well.
Seems to work well to disable/enable access really quickly.

lib/authorization/index.js

@@ -9,6 +9,7 @@ var consts = require('./../constants');
 function init (env, ctx) {
   var authorization = { };
   var storage = authorization.storage = require('./storage')(env, ctx);
+  var defaultRoles = (env.settings.authDefaultRoles || '').split(/[, :]/);
 
   function extractToken (req) {
     var token;
@@ -50,7 +51,7 @@ function init (env, ctx) {
     return permissions;
   };
 
-  authorization.isPermitted = function isPermitted (permission) {
+  authorization.isPermitted = function isPermitted (permission, opts) {
 
 
     authorization.seenPermissions = _.chain(authorization.seenPermissions)
@@ -68,7 +69,11 @@ function init (env, ctx) {
 
       var token = extractToken(req);
 
-      if (token) {
+      req.auth = token;
+      var builtin = shiroTrie.new();
+      var defaultPermissions = storage.rolesToPermissions(defaultRoles);
+      builtin.add(defaultPermissions);
+      if (token && bultin.length < 0) {
         jwt.verify(token, env.api_secret, function result(err, verified) {
           if (err) {
             console.info('Error verifying Authorized Token', err);
@@ -76,8 +81,8 @@ function init (env, ctx) {
           } else {
             console.info('Verified Authorization', verified);
             var permissions = storage.findSubjectPermissions(verified.accessToken);
-            console.info('checking', permissions, 'for', permission);
-            if (permissions.check(permission)) {
+            // permissions.add(defaultPermissions);
+            if (permissions.check(permission) || builtin.check(permission)) {
               next( );
             } else {
               res.sendJSONStatus(res, consts.HTTP_UNAUTHORIZED, 'Unauthorized', 'Invalid/Missing');
@@ -85,6 +90,9 @@ function init (env, ctx) {
           }
         });
       } else {
+        if (builtin.check(permission)) {
+          return next( );
+        }
         res.sendJSONStatus(res, consts.HTTP_UNAUTHORIZED, 'Unauthorized', 'Invalid/Missing');
       }
 
@@ -121,4 +129,4 @@ function init (env, ctx) {
   return authorization;
 }
 
-module.exports = init;
+module.exports = init;