Kai/habitica
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proper accessControl testing of server routes, fix REST

Browse Source
This commit is contained in:
Tyler Renelle
2013-02-05 21:28:05 -05:00
parent 3ff08a49d2
commit b6e7ebb6ca
3 changed files with 20 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/server/store.coffee
+7 -7
View File
@@ -17,7 +17,7 @@ userAccess = (store) ->
#return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
uid = arguments[0]
next = arguments[arguments.length - 1]
next (uid is @session.userId) or @req._isServer
next (uid is @session.userId) or @session.req?._isServer
store.writeAccess "*", "users.*", -> # captures, value, next) ->
#return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
@@ -30,7 +30,7 @@ userAccess = (store) ->
return next(true)
# Same session (user.id = this.session.userId)
if (uid is @session.userId) or @req._isServer
if (uid is @session.userId) or @session.req?._isServer
return next(true)
next(false)
@@ -39,12 +39,12 @@ userAccess = (store) ->
#return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
oldBalance = @session.req._racerModel?.get("users.#{id}.balance") || 0
purchasingSomethingOnClient = newBalance < oldBalance
next(purchasingSomethingOnClient or @req._isServer)
next(purchasingSomethingOnClient or @session.req?._isServer)
store.writeAccess "*", "users.*.flags.ads", -> # captures, value, next ->
#return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
next = arguments[arguments.length - 1]
next(@req._isServer)
next(@session.req?._isServer)
###
@@ -52,12 +52,12 @@ userAccess = (store) ->
Get user with API token
###
REST = (store) ->
store.query.expose "users", "withIdAndToken", (id, api_token) ->
store.query.expose "users", "withIdAndToken", (id, apiToken) ->
@where("id").equals(id)
.where('preferences.api_token').equals(api_token)
.where('apiToken').equals(apiToken)
.limit(1)
store.queryAccess "users", "withIdAndToken", (id, token, next) ->
store.queryAccess "users", "withIdAndToken", (id, apiToken, next) ->
#return next(false) unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
next(true) # only user has id & token