bckelley/cgm-remote-monitor
1
0
Fork 0
mirror of https://github.com/bckelley/cgm-remote-monitor.git synced 2026-08-24 03:14:12 -05:00
Code Issues Packages Projects Releases Wiki Activity

Use auth tokens in api-secret (#5214)

Browse Source 
* Allow auth tokens to be passed in the api-secret header and used in the client in place of the API secret

* Fix unit test

* Fix admin test

* Reload page when token is used as a secret
This commit is contained in:
Sulka Haro
2019-12-06 12:27:54 +02:00
committed by GitHub
parent 6abd6bed27
commit 7b58a2251f
10 changed files with 130 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/authorization/index.js
+26 -3
View File
@@ -141,14 +141,19 @@ function init (env, ctx) {
authorization.resolve = function resolve (data, callback) {
var defaultShiros = storage.rolesToShiros(defaultRoles);
if (storage.doesAccessTokenExist(data.api_secret)) {
authorization.resolveAccessToken (data.api_secret, callback, defaultShiros);
return;
}
if (authorizeAdminSecret(data.api_secret)) {
var admin = shiroTrie.new();
admin.add(['*']);
return callback(null, { shiros: [ admin ] });
}
var defaultShiros = storage.rolesToShiros(defaultRoles);
if (data.token) {
jwt.verify(data.token, env.api_secret, function result(err, verified) {
if (err) {
@@ -192,6 +197,25 @@ function init (env, ctx) {
var remoteIP = getRemoteIP(req);
var secret = adminSecretFromRequest(req);
var defaultShiros = storage.rolesToShiros(defaultRoles);
if (storage.doesAccessTokenExist(secret)) {
var resolved = storage.resolveSubjectAndPermissions (secret);
if (authorization.checkMultiple(permission, resolved.shiros)) {
console.log(LOG_GRANTED, remoteIP, resolved.accessToken , permission);
next();
} else if (authorization.checkMultiple(permission, defaultShiros)) {
console.log(LOG_GRANTED, remoteIP, resolved.accessToken, permission, 'default');
next( );
} else {
console.log(LOG_DENIED, remoteIP, resolved.accessToken, permission);
res.sendJSONStatus(res, consts.HTTP_UNAUTHORIZED, 'Unauthorized', 'Invalid/Missing');
}
return;
}
if (authorizeAdminSecretWithRequest(req)) {
console.log(LOG_GRANTED, remoteIP, 'api-secret', permission);
next( );
@@ -199,7 +223,6 @@ function init (env, ctx) {
}
var token = extractToken(req);
var defaultShiros = storage.rolesToShiros(defaultRoles);
if (token) {
jwt.verify(token, env.api_secret, function result(err, verified) {