2016-09-30 14:45:59 +03:00
|
|
|
var passport = require('passport'),
|
|
|
|
errors = require('../errors'),
|
|
|
|
events = require('../events'),
|
|
|
|
i18n = require('../i18n'),
|
|
|
|
authenticate;
|
2015-10-22 16:28:47 +03:00
|
|
|
|
|
|
|
function isBearerAutorizationHeader(req) {
|
|
|
|
var parts,
|
|
|
|
scheme,
|
|
|
|
credentials;
|
|
|
|
|
|
|
|
if (req.headers && req.headers.authorization) {
|
|
|
|
parts = req.headers.authorization.split(' ');
|
2015-11-12 20:26:18 +03:00
|
|
|
} else if (req.query && req.query.access_token) {
|
|
|
|
return true;
|
2015-10-22 16:28:47 +03:00
|
|
|
} else {
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (parts.length === 2) {
|
|
|
|
scheme = parts[0];
|
|
|
|
credentials = parts[1];
|
|
|
|
if (/^Bearer$/i.test(scheme)) {
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2016-09-30 14:45:59 +03:00
|
|
|
authenticate = {
|
2015-10-22 16:28:47 +03:00
|
|
|
// ### Authenticate Client Middleware
|
|
|
|
authenticateClient: function authenticateClient(req, res, next) {
|
|
|
|
// skip client authentication if bearer token is present
|
|
|
|
if (isBearerAutorizationHeader(req)) {
|
|
|
|
return next();
|
|
|
|
}
|
|
|
|
|
|
|
|
if (req.query && req.query.client_id) {
|
|
|
|
req.body.client_id = req.query.client_id;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (req.query && req.query.client_secret) {
|
|
|
|
req.body.client_secret = req.query.client_secret;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!req.body.client_id || !req.body.client_secret) {
|
2016-10-04 18:33:43 +03:00
|
|
|
return next(new errors.UnauthorizedError(
|
|
|
|
i18n.t('errors.middleware.auth.accessDenied')),
|
2015-11-12 15:29:45 +03:00
|
|
|
i18n.t('errors.middleware.auth.clientCredentialsNotProvided'),
|
|
|
|
i18n.t('errors.middleware.auth.forInformationRead', {url: 'http://api.ghost.org/docs/client-authentication'})
|
2015-12-14 18:35:19 +03:00
|
|
|
);
|
2015-10-22 16:28:47 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
return passport.authenticate(['oauth2-client-password'], {session: false, failWithError: false},
|
|
|
|
function authenticate(err, client) {
|
|
|
|
if (err) {
|
|
|
|
return next(err); // will generate a 500 error
|
|
|
|
}
|
|
|
|
|
2015-10-28 21:39:10 +03:00
|
|
|
// req.body needs to be null for GET requests to build options correctly
|
|
|
|
delete req.body.client_id;
|
|
|
|
delete req.body.client_secret;
|
|
|
|
|
2016-04-14 18:54:49 +03:00
|
|
|
if (!client) {
|
2016-10-04 18:33:43 +03:00
|
|
|
return next(new errors.UnauthorizedError(
|
|
|
|
i18n.t('errors.middleware.auth.accessDenied')),
|
2015-11-12 15:29:45 +03:00
|
|
|
i18n.t('errors.middleware.auth.clientCredentialsNotValid'),
|
|
|
|
i18n.t('errors.middleware.auth.forInformationRead', {url: 'http://api.ghost.org/docs/client-authentication'})
|
2015-12-14 18:35:19 +03:00
|
|
|
);
|
|
|
|
}
|
|
|
|
|
2016-03-26 21:26:57 +03:00
|
|
|
req.client = client;
|
2016-03-27 01:28:00 +03:00
|
|
|
|
2016-04-04 05:40:23 +03:00
|
|
|
events.emit('client.authenticated', client);
|
2016-03-26 21:26:57 +03:00
|
|
|
return next(null, client);
|
2015-10-22 16:28:47 +03:00
|
|
|
}
|
|
|
|
)(req, res, next);
|
|
|
|
},
|
|
|
|
|
|
|
|
// ### Authenticate User Middleware
|
|
|
|
authenticateUser: function authenticateUser(req, res, next) {
|
|
|
|
return passport.authenticate('bearer', {session: false, failWithError: false},
|
|
|
|
function authenticate(err, user, info) {
|
|
|
|
if (err) {
|
|
|
|
return next(err); // will generate a 500 error
|
|
|
|
}
|
|
|
|
|
|
|
|
if (user) {
|
|
|
|
req.authInfo = info;
|
|
|
|
req.user = user;
|
2016-04-04 05:40:23 +03:00
|
|
|
|
|
|
|
events.emit('user.authenticated', user);
|
2015-10-22 16:28:47 +03:00
|
|
|
return next(null, user, info);
|
|
|
|
} else if (isBearerAutorizationHeader(req)) {
|
2016-10-04 18:33:43 +03:00
|
|
|
return next(new errors.UnauthorizedError(i18n.t('errors.middleware.auth.accessDenied')));
|
2015-10-22 16:28:47 +03:00
|
|
|
} else if (req.client) {
|
2016-04-14 23:44:05 +03:00
|
|
|
req.user = {id: 0};
|
2015-10-22 16:28:47 +03:00
|
|
|
return next();
|
|
|
|
}
|
|
|
|
|
2016-10-04 18:33:43 +03:00
|
|
|
return next(new errors.UnauthorizedError(i18n.t('errors.middleware.auth.accessDenied')));
|
2015-10-22 16:28:47 +03:00
|
|
|
}
|
|
|
|
)(req, res, next);
|
|
|
|
},
|
|
|
|
|
2016-09-30 14:45:59 +03:00
|
|
|
// ### Authenticate Ghost.org User
|
|
|
|
authenticateGhostUser: function authenticateGhostUser(req, res, next) {
|
|
|
|
req.query.code = req.body.authorizationCode;
|
|
|
|
|
|
|
|
if (!req.query.code) {
|
2016-10-04 18:33:43 +03:00
|
|
|
return next(new errors.UnauthorizedError(i18n.t('errors.middleware.auth.accessDenied')));
|
2015-10-22 16:28:47 +03:00
|
|
|
}
|
|
|
|
|
2016-09-30 14:45:59 +03:00
|
|
|
passport.authenticate('ghost', {session: false, failWithError: false}, function authenticate(err, user, info) {
|
|
|
|
if (err) {
|
|
|
|
return next(err);
|
2015-10-23 12:03:38 +03:00
|
|
|
}
|
2016-09-30 14:45:59 +03:00
|
|
|
|
|
|
|
if (!user) {
|
2016-10-04 18:33:43 +03:00
|
|
|
return next(new errors.UnauthorizedError(i18n.t('errors.middleware.auth.accessDenied')));
|
2016-09-30 14:45:59 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
req.authInfo = info;
|
|
|
|
req.user = user;
|
|
|
|
next();
|
|
|
|
})(req, res, next);
|
2015-10-22 16:28:47 +03:00
|
|
|
}
|
|
|
|
};
|
|
|
|
|
2016-09-30 14:45:59 +03:00
|
|
|
module.exports = authenticate;
|