From 6fe375114c4b5e49c49d1a0e91f22fabc10dfae2 Mon Sep 17 00:00:00 2001
From: Tyler Renelle <tylerrenelle@gmail.com>
Date: Thu, 28 Feb 2013 20:00:08 -0500
Subject: [PATCH] set req._isServer=true for API calls, use that as access
 check

---
 src/server/api.coffee   | 1 +
 src/server/store.coffee | 7 ++-----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/server/api.coffee b/src/server/api.coffee
index c98384f47b..09824e294c 100644
--- a/src/server/api.coffee
+++ b/src/server/api.coffee
@@ -33,6 +33,7 @@ auth = (req, res, next) ->
     req.user = user
     req.userObj = user.get()
     return res.json 401, NO_USER_FOUND if !req.userObj || _.isEmpty(req.userObj)
+    req._isServer = true
     next()
 
 router.get '/status', (req, res) ->
diff --git a/src/server/store.coffee b/src/server/store.coffee
index 659d890685..ac4ab491af 100644
--- a/src/server/store.coffee
+++ b/src/server/store.coffee
@@ -30,9 +30,7 @@ userAccess = (store) ->
     err = arguments[arguments.length - 1]
     # return err(derbyAuth.SESSION_INVALIDATED_ERROR) if derbyAuth.bustedSession(@)
 
-    # TEMPORARY token check to allow api
-    # Must fix before release
-    return accept(true)
+    return accept(true) if derbyAuth.isServer(@)
 
     return accept(false) if derbyAuth.bustedSession(@)
 
@@ -45,8 +43,7 @@ userAccess = (store) ->
       return accept(true)
 
     # Same session (user.id = this.session.userId)
-    if (uid is @session.userId) or derbyAuth.isServer(@)
-      return accept(true)
+    return accept(true) if uid is @session.userId
 
     accept(false)