Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-06 22:40:14 -05:00
Code Issues Activity

Enabled Admin API key authentication

Browse source 
refs #9865
This commit is contained in:
Nazar Gargol 2019-01-30 19:17:25 +00:00
parent eafbaaeba5
commit 59036577af
2 changed files with 1 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
core/server/services/auth/authenticate.js
View file

@ -102,9 +102,7 @@ const authenticate = {
)(req, res, next);
},
// @NOTE: authentication for admin api keys is disabled
// authenticateAdminApi: [apiKeyAuth.admin.authenticate, session.authenticate],
authenticateAdminApi: [session.authenticate],
authenticateAdminApi: [apiKeyAuth.admin.authenticate, session.authenticate],
authenticateContentApi: [apiKeyAuth.content.authenticateContentApiKey, members.authenticateMembersToken]
};

24
core/test/acceptance/old/admin/key_authentication_spec.js
View file

@ -7,7 +7,6 @@ const config = require('../../../../server/config');
const ghost = testUtils.startGhost;
// TODO: remove this suite once Admin API key auth is enabled
describe('Admin API V2 key authentication', function () {
let request;
@ -21,29 +20,6 @@ describe('Admin API V2 key authentication', function () {
});
});
it('browse with correct GET endpoint token', function () {
return request.get(localUtils.API.getApiQuery('posts/'))
.set('Authorization', `Ghost ${localUtils.getValidAdminToken(localUtils.API.getApiQuery('posts/'))}`)
.expect('Content-Type', /json/)
.expect('Cache-Control', testUtils.cacheRules.private)
.expect(403);
});
});
// TODO: enable this suite once Admin API key auth is enabled
describe.skip('Admin API V2 key authentication', function () {
let request;
before(function () {
return ghost()
.then(function (_ghostServer) {
request = supertest.agent(config.get('url'));
})
.then(function () {
return testUtils.initFixtures('api_keys');
});
});
it('do not authenticate without token header', function () {
return request.get(localUtils.API.getApiQuery('posts/'))
.set('Authorization', `Ghost`)