accessControl basic framework for party system

src/server/index.coffee

@@ -8,6 +8,7 @@ serverError = require './serverError'
 MongoStore = require('connect-mongo')(express)
 auth = require 'derby-auth'
 priv = require './private'
+habitrpgStore = require('./store')
 
 ## Run server cron ##
 require('./cron').deleteStaleAccounts()
@@ -31,7 +32,6 @@ derby.use(require 'racer-db-mongo')
 store = derby.createStore
   db: {type: 'Mongo', uri: process.env.NODE_DB_URI, safe:true}
   listen: server
-require('./store')(store) #setup custom accessControl
 
 ONE_YEAR = 1000 * 60 * 60 * 24 * 365
 root = path.dirname path.dirname __dirname
@@ -48,6 +48,7 @@ options =
   domain: process.env.BASE_URL || 'http://localhost:3000'
   allowPurl: true
   schema: require('../app/schema').newUserObject()
+  customAccessControl: habitrpgStore.customAccessControl
 
 mongo_store = new MongoStore {url: process.env.NODE_DB_URI}, ->
   expressApp

src/server/store.coffee

@@ -2,7 +2,41 @@
 Setup read / write access
 @param store
 ###
-module.exports = (store) ->
+
+module.exports.customAccessControl = (store) ->
+
+#  store.readPathAccess "users.*", () -> # captures, next
+#    next = arguments[arguments.length-1]
+#    return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
+#    return next(true)
+
+  store.readPathAccess "users.*", -> # captures, next) ->
+    return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
+    console.log arguments
+    captures = arguments[0]
+    next = arguments[arguments.length - 1]
+    sameSession = captures is @session.userId
+    isServer = false #!this.req.socket; //TODO how to determine if request came from server, as in REST?
+    next sameSession or isServer
+
+  store.writeAccess "*", "users.*", -> # captures, value, next) ->
+    return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
+    [captures, next] = [arguments[0].split('.'), arguments[arguments.length-1]]
+    uid = captures.shift()
+    attrPath = captures.join('.') # new array shifted left, after shift() was run
+
+    # TODO the server can write to anything - aka, REST
+    #return next(true) if !this.req.socket;
+
+    # public access to users.*.party.invitation (TODO, lock down a bit more)
+    console.log attrPath
+    return next(true) if (attrPath == 'party.invitation')
+
+    # Same session (user.id = this.session.userId)
+    return next(true) if uid is @session.userId
+
+    next(false)
+
 
 #  store.writeAccess "*", "users.*.balance", (id, newBalance, next) ->
 #    return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
@@ -34,7 +68,19 @@ module.exports = (store) ->
   ###
   store.query.expose "users", "party", (ids) ->
     @where("id").within(ids)
-      .only('stats', 'preferences.gender', 'preferences.armorSet', 'items', 'auth.local.username', 'auth.facebook.displayName')
+      .only('stats',
+            'items',
+            'party',
+            'preferences.gender',
+            'preferences.armorSet',
+            'auth.local.username',
+            'auth.facebook.displayName')
 
   store.queryAccess "users", "party", (ids, next) ->
     next(true) # no harm in public user stats
+
+  store.readPathAccess "parties.*", ->
+    arguments[arguments.length-1](true)
+
+  store.writeAccess "*", "parties.*", ->
+    arguments[arguments.length-1](true)