jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Map group roles to scopes

Browse Source
This commit is contained in:
Girish Ramakrishnan
2018-06-18 14:21:54 -07:00
parent b5c8e7a52a
commit 6cd0601629
5 changed files with 50 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/routes/accesscontrol.js
View File

@@ -101,13 +101,13 @@ function accessTokenAuth(accessToken, callback) {
if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, null /* user */, 'Invalid Token'); // will end up as a 401
if (error) return callback(error); // this triggers 'internal error' in passport
users.get(token.identifier, function (error, user) {
users.getWithRoles(token.identifier, function (error, user) {
if (error && error.reason === UsersError.NOT_FOUND) return callback(null, null /* user */, 'Invalid Token'); // will end up as a 401
if (error) return callback(error);
// scopes here can define what capabilities that token carries
// passport put the 'info' object into req.authInfo, where we can further validate the scopes
const userScopes = user.groupIds.indexOf(constants.ADMIN_GROUP_ID) !== -1 ? accesscontrol.VALID_SCOPES : [ 'profile' ];
const userScopes = accesscontrol.scopesForRoles(user.roles);
var authorizedScopes = accesscontrol.intersectScopes(userScopes, token.scope.split(','));
// these clients do not require password checks unlike UI
const skipPasswordVerification = token.clientId === 'cid-sdk' || token.clientId === 'cid-cli';