mirror of
https://github.com/TryGhost/Ghost.git
synced 2025-01-27 22:49:56 -05:00
9be9531ef8
* Added admin specific auth{enticate,orize} middleware
refs #9865
This middleware will be used by the admin api to authenticate and
authorize requests
* Update v2/admin to use authAdminApi middleware
refs #9865
This changes thh auth middleware to use the adminApi authenticate and
authorize middlewares underneath, it also renames the middleware to be
consistent with the naming of the api.
* Removed oauth specific endpoints from /v2/admin
refs #9865
These are not to be used in v2/admin
* Wired up the session controller to the admin api
refs #9865
These endpoints will be used by ghost admin to login, confirm logged in status and logout
43 lines
1.6 KiB
JavaScript
43 lines
1.6 KiB
JavaScript
const labs = require('../labs');
|
|
const session = require('./session');
|
|
const common = require('../../lib/common');
|
|
|
|
const authorize = {
|
|
// Workaround for missing permissions
|
|
// TODO: rework when https://github.com/TryGhost/Ghost/issues/3911 is done
|
|
requiresAuthorizedUser: function requiresAuthorizedUser(req, res, next) {
|
|
if (req.user && req.user.id) {
|
|
return next();
|
|
} else {
|
|
return next(new common.errors.NoPermissionError({message: common.i18n.t('errors.middleware.auth.pleaseSignIn')}));
|
|
}
|
|
},
|
|
|
|
// ### Require user depending on public API being activated.
|
|
requiresAuthorizedUserPublicAPI: function requiresAuthorizedUserPublicAPI(req, res, next) {
|
|
if (labs.isSet('publicAPI') === true) {
|
|
return next();
|
|
} else {
|
|
if (req.user && req.user.id) {
|
|
return next();
|
|
} else {
|
|
return next(new common.errors.NoPermissionError({message: common.i18n.t('errors.middleware.auth.pleaseSignIn')}));
|
|
}
|
|
}
|
|
},
|
|
|
|
// Requires the authenticated client to match specific client
|
|
requiresAuthorizedClient: function requiresAuthorizedClient(client) {
|
|
return function doAuthorizedClient(req, res, next) {
|
|
if (client && (!req.client || !req.client.name || req.client.name !== client)) {
|
|
return next(new common.errors.NoPermissionError({message: common.i18n.t('errors.permissions.noPermissionToAction')}));
|
|
}
|
|
|
|
return next();
|
|
};
|
|
},
|
|
|
|
authorizeAdminAPI: [session.ensureUser]
|
|
};
|
|
|
|
module.exports = authorize;
|