Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-06 22:40:14 -05:00
Code Issues Activity

Check client is enabled before auth

Browse source 
no issue

- add a check that the client has status 'enabled' to client auth strategy
- this permits the disabling of clients easily
- update tests
This commit is contained in:
Hannah Wolfe 2015-11-04 16:59:56 +00:00
parent eb3cce0235
commit 19603a33f3
2 changed files with 18 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
core/server/middleware/auth-strategies.js
View file

@ -17,7 +17,7 @@ strategies = {
.then(function then(model) {
if (model) {
var client = model.toJSON({include: ['trustedDomains']});
if (client.secret === clientSecret) {
if (client.status === 'enabled' && client.secret === clientSecret) {
return done(null, client);
}
}

18
core/test/unit/middleware/auth-strategies_spec.js
View file

@ -12,7 +12,8 @@ var should = require('should'),
fakeClient = {
slug: 'ghost-admin',
secret: 'not_available'
secret: 'not_available',
status: 'enabled'
},
fakeValidToken = {
@ -96,6 +97,21 @@ describe('Auth Strategies', function () {
done();
}).catch(done);
});
it('shouldn\'t auth client that is disabled', function (done) {
var clientId = 'ghost-admin',
clientSecret = 'not_available';
fakeClient.status = 'disabled';
authStrategies.clientPasswordStrategy(clientId, clientSecret, next).then(function () {
clientStub.calledOnce.should.be.true;
clientStub.calledWith({slug: clientId}).should.be.true;
next.called.should.be.true;
next.calledWith(null, false).should.be.true;
done();
}).catch(done);
});
});
describe('Bearer Strategy', function () {