jjkiers/cloudron-box
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Add authorization to all routes

Browse Source
This commit is contained in:
Johannes Zellner
2022-09-24 21:27:43 +02:00
parent cde22cd0a3
commit 8677e86ace
3 changed files with 48 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/routes/accesscontrol.js
View File

@@ -94,6 +94,7 @@ function authorize(requiredRole) {
return function (req, res, next) {
assert.strictEqual(typeof req.user, 'object');
assert.strictEqual(typeof req.token, 'object');
if (users.compareRoles(req.user.role, requiredRole) < 0) return next(new HttpError(403, `role '${requiredRole}' is required but user has only '${req.user.role}'`));
if (!tokens.hasScope(req.token, req.method, req.path)) return next(new HttpError(403, 'access token does not have this scope'));
@@ -106,6 +107,7 @@ async function authorizeOperator(req, res, next) {
assert.strictEqual(typeof req.params.id, 'string');
assert.strictEqual(typeof req.user, 'object');
assert.strictEqual(typeof req.app, 'object');
assert.strictEqual(typeof req.token, 'object');
if (!tokens.hasScope(req.token, req.method, req.path)) return next(new HttpError(403, 'access token does not have this scope'));
if (apps.isOperator(req.app, req.user)) return next();