wiki-cafe/wiki-security-passportjs
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

restrict json access to owner

Browse Source
This commit is contained in:
Ward Cunningham
2018-08-26 21:15:49 -07:00
parent 02fa8002d4
commit 280dabddeb
2 changed files with 23 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package.json
View File

@ -8,7 +8,7 @@
"coffeescript": "^1.12.7", "coffeescript": "^1.12.7",
"es6-promise": "^4.1.1", "es6-promise": "^4.1.1",
"lodash": "^4.17.4", "lodash": "^4.17.4",
"passport": "^0.4.0", "passport": "0.3.2",
"passport-github": "^1.1.0", "passport-github": "^1.1.0",
"passport-google-oauth20": "^1.0.0", "passport-google-oauth20": "^1.0.0",
"passport-twitter": "^1.0.4", "passport-twitter": "^1.0.4",

29
server/social.coffee
View File

@ -387,17 +387,32 @@ module.exports = exports = (log, loga, argv) ->
} }
res.render(path.join(__dirname, '..', 'views', 'done.html'), info) res.render(path.join(__dirname, '..', 'views', 'done.html'), info)
# if configured, enforce restricted access # if configured, enforce restricted access to json
if argv.restricted? if argv.restricted?
app.all('*', (req, res, next) -> app.all '*', (req, res, next) ->
# add code here to determine if user should have access to site. return next() unless /\.json$/.test req.url
#
# like authorized(req,res,nex) but more universal and adjustable
console.log '--------------------------------------------'
console.log 'url',req.url
console.log 'owner',owner
console.log 'owner email',owner.google?.emails
console.log 'user',req.session?.passport?.user
console.log 'user',req.session?.passport?.user?.google?.emails
console.log '--------------------------------------------'
# if access if to be allowed call `next()` # if access if to be allowed call `next()`
#
if isAuthorized req
next()
# if access is not allowed display a splash screen, # if access is not allowed display a splash screen,
# this will need a login link that call the same code as clicking on the padlock # this will need a login link that call the same code as clicking on the padlock
#
) else
# next()
res.status(200).json({title: "Login Required"})
app.get '/auth/addAuthDialog', (req, res) -> app.get '/auth/addAuthDialog', (req, res) ->
# only makes sense to add alternative authentication scheme if # only makes sense to add alternative authentication scheme if