Kai/habitica
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proper accessControl testing of server routes, fix REST

Browse Source
This commit is contained in:
Tyler Renelle
2013-02-05 21:28:05 -05:00
parent 3ff08a49d2
commit b6e7ebb6ca
3 changed files with 20 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server/serverRoutes.coffee
+12 -10
View File
@@ -17,33 +17,33 @@ module.exports = (expressApp, root, derby) ->
deprecatedMessage = 'This API is no longer supported, see https://github.com/lefnire/habitrpg/wiki/API for new protocol'
expressApp.get '/:uid/up/:score?', (req, res) -> res.send(500, deprecatedMessage)
expressApp.get '/:uid/down/:score?', (req, res) -> res.send(500, deprecatedMessage)
expressApp.post '/v1/users/:uid/tasks/:taskId/:direction', (req, res) -> res.send(500, deprecatedMessage)
expressApp.post '/users/:uid/tasks/:taskId/:direction', (req, res) -> res.send(500, deprecatedMessage)
# ---------- v1 API ------------
###
v1 API. Requires user-id and api_token, task-id, direction. Test with:
curl -X POST -H "Content-Type:application/json" -d '{"api_token":"{TOKEN}"}' localhost:3000/v1/users/{UID}/tasks/productivity/up
v1 API. Requires user-id and apiToken, task-id, direction. Test with:
curl -X POST -H "Content-Type:application/json" -d '{"apiToken":"{TOKEN}"}' localhost:3000/v1/users/{UID}/tasks/productivity/up
###
# TODO /v1/..
expressApp.post '/users/:uid/tasks/:taskId/:direction', (req, res) ->
expressApp.post '/v1/users/:uid/tasks/:taskId/:direction', (req, res) ->
{uid, taskId, direction} = req.params
{api_token, title, service, icon} = req.body
{apiToken, title, service, icon} = req.body
console.log {params:req.params, body:req.body} if process.env.NODE_ENV == 'development'
# Send error responses for improper API call
return res.send(500, 'request body "api_token" required') unless api_token
return res.send(500, 'request body "apiToken" required') unless apiToken
return res.send(500, ':uid required') unless uid
return res.send(500, ':taskId required') unless taskId
return res.send(500, ":direction must be 'up' or 'down'") unless direction in ['up','down']
model = req.getModel()
model.fetch model.query('users').withIdAndToken(uid, api_token), (err, result) ->
req._isServer = true
model.fetch model.query('users').withIdAndToken(uid, apiToken), (err, result) ->
return res.send(500, err) if err
user = result.at(0)
userObj = user.get()
if _.isEmpty(userObj)
return res.send(500, "User with uid=#{uid}, token=#{api_token} not found. Make sure you're not using your username, but your User Id")
return res.send(500, "User with uid=#{uid}, token=#{apiToken} not found. Make sure you're not using your username, but your User Id")
model.ref('_user', user)
@@ -59,7 +59,9 @@ module.exports = (expressApp, root, derby) ->
up: true
down: true
notes: "This task was created by a third-party service. Feel free to edit, it won't harm the connection to that service. Additionally, multiple services may piggy-back off this task."
}
}, (a,b,c) ->
console.log {a:a,b:b,c:c}
scoring.setModel(model)
delta = scoring.score(taskId, direction)