From 0af72f0c68941f92f2f7b5fcc1e85352d12c2295 Mon Sep 17 00:00:00 2001
From: Chris Breneman <crispy@cluenet.org>
Date: Tue, 24 Feb 2015 22:21:57 -0500
Subject: [PATCH] Pass allow_access calls that don't use the can() middleware
 through the plugin interface

---
 conf/full.yaml   |  2 +-
 lib/index-api.js | 21 +++++++++++++--------
 lib/index-web.js | 28 ++++++++++++++++------------
 lib/packages.js  |  6 +++++-
 4 files changed, 35 insertions(+), 22 deletions(-)

diff --git a/conf/full.yaml b/conf/full.yaml
index 88ef49259..acc8fe923 100644
--- a/conf/full.yaml
+++ b/conf/full.yaml
@@ -59,7 +59,7 @@ packages:
   #  # you can override storage directory for a group of packages this way:
   #  storage: 'local_storage'
 
-  # Delegate handling package access authorization and settings to an external
+  # Delegate handling package access authorization to an external
   # plugin for packages with this prefix
   #'external-*':
   #  plugin: my_plugin
diff --git a/lib/index-api.js b/lib/index-api.js
index e8ad70c86..f1d7aa8fa 100644
--- a/lib/index-api.js
+++ b/lib/index-api.js
@@ -10,10 +10,11 @@ var match         = Middleware.match
 var media         = Middleware.media
 var validate_name = Middleware.validate_name
 var validate_pkg  = Middleware.validate_package
+var async         = require('async')
 
-module.exports = function(config, auth, storage, packages) {
+module.exports = function(config, auth, storage, package_provider) {
   var app = express.Router()
-  var can = Middleware.allow(config, packages)
+  var can = Middleware.allow(config, package_provider)
 
   // validate all of these params as a package name
   // this might be too harsh, so ask if it causes trouble
@@ -85,12 +86,16 @@ module.exports = function(config, auth, storage, packages) {
   app.get('/-/all/:anything?', function(req, res, next) {
     storage.search(req.param.startkey || 0, {req: req}, function(err, result) {
       if (err) return next(err)
-      for (var pkg in result) {
-        if (!config.allow_access(pkg, req.remote_user)) {
-          delete result[pkg]
-        }
-      }
-      return next(result)
+      async.eachSeries(Object.keys(result), function(pkg, cb) {
+        package_provider.allow_access(pkg, req.remote_user, function(err, allowed) {
+          if(err) return cb(err)
+          if(!allowed) delete result[pkg]
+          cb()
+        })
+      }, function(err) {
+        if(err) return next(err)
+        next(result)
+      })
     })
   })
 
diff --git a/lib/index-web.js b/lib/index-web.js
index 414bf2d4b..9f48f3d22 100644
--- a/lib/index-web.js
+++ b/lib/index-web.js
@@ -5,15 +5,16 @@ var fs            = require('fs')
 var Handlebars    = require('handlebars')
 var Error         = require('http-errors')
 var renderReadme  = require('render-readme')
+var async         = require('async')
 var Search        = require('./search')
 var Middleware    = require('./middleware')
 var match         = Middleware.match
 var validate_name = Middleware.validate_name
 var validate_pkg  = Middleware.validate_package
 
-module.exports = function(config, auth, storage, packages) {
+module.exports = function(config, auth, storage, package_provider) {
   var app = express.Router()
-  var can = Middleware.allow(config, packages)
+  var can = Middleware.allow(config, package_provider)
 
   // validate all of these params as a package name
   // this might be too harsh, so ask if it causes trouble
@@ -42,17 +43,20 @@ module.exports = function(config, auth, storage, packages) {
 
     storage.get_local(function(err, packages) {
       if (err) throw err // that function shouldn't produce any
-      next(template({
-        name:       config.web && config.web.title ? config.web.title : 'Sinopia',
-        packages:   packages.filter(allow),
-        baseUrl:    base,
-        username:   req.remote_user.name,
-      }))
+      async.filterSeries(packages, function(package, cb) {
+        package_provider.allow_access(package.name, req.remote_user, function(err, allowed) {
+          if(err) cb(false)
+          else cb(allowed)
+        })
+      }, function(packages) {
+        next(template({
+          name:       config.web && config.web.title ? config.web.title : 'Sinopia',
+          packages:   packages,
+          baseUrl:    base,
+          username:   req.remote_user.name,
+        }))
+      })
     })
-
-    function allow(package) {
-      return config.allow_access(package.name, req.remote_user)
-    }
   })
 
   // Static
diff --git a/lib/packages.js b/lib/packages.js
index ed9539ebf..4ba6dbc43 100644
--- a/lib/packages.js
+++ b/lib/packages.js
@@ -53,7 +53,11 @@ function check_plugin_result(function_name, package, arg, cb) {
     if(error) {
       cb(error)
     } else {
-      cb(null, current_result)
+      if(current_result === undefined) {
+        self.default_plugin[function_name](package, arg, cb)
+      } else {
+        cb(null, current_result)
+      }
     }
   })
 }