c234aa3616
Update formAJAX function to log data from the server Add getUserByEmail and checkEmail functions Update profile.ejs to require login Update addSensorData function to emit new sensor data Update api.css with styling changes Update token route to generate and send token email Update authChecker middleware to allow user and token routes
49 lines
1.6 KiB
JavaScript
49 lines
1.6 KiB
JavaScript
const { getTokenByToken } = require("../functions/api");
|
|
|
|
const permissionError = new Error('PermissionError')
|
|
permissionError.name = "Inadequate Permission Error"
|
|
permissionError.status = 401
|
|
permissionError.message = "Inadequate permission to complete this response"
|
|
|
|
async function auth(req, res, next) {
|
|
try {
|
|
const token = await getTokenByToken(req.header("auth-token"));
|
|
|
|
if (!token || !token.isValid){
|
|
throw permissionError;
|
|
}
|
|
|
|
//if token is a match
|
|
req.token = token;
|
|
req.user = await token.getUser();
|
|
|
|
const route = req.originalUrl.split("?")[0]; // Removing query parameters
|
|
//if route is from user/ and permission is canRead allow it to do CRUD
|
|
if (route.includes("/user/") || route.includes("/token/") && token.permission === "canRead") {
|
|
console.log("user route");
|
|
return next();
|
|
}
|
|
if ((req.method === "GET" && token.permission === "canRead")){
|
|
console.log("wtf you shldnt be here");
|
|
return next();
|
|
}
|
|
if (["GET", "POST", "PUT", "DELETE"].includes(req.method) && token.permission === "canWrite") {
|
|
console.log("wtf you shldnt be here");
|
|
return next();
|
|
}
|
|
/*
|
|
if ((req.method === "GET" && token.permission === "canRead") ||
|
|
(["GET", "POST", "PUT", "DELETE"].includes(req.method) && token.permission === "canWrite")) {
|
|
return next();
|
|
}
|
|
*/
|
|
|
|
throw permissionError
|
|
|
|
} catch (error) {
|
|
next(error);
|
|
}
|
|
}
|
|
module.exports = { auth };
|
|
|