TryGhost/Ghost
1
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2024-11-30 21:40:39 +03:00
Code Issues Projects Releases Wiki Activity

♻ Updated naming for Content API specific middleware

Browse Source 
no-issue

This is because the Content API will eventually be accessed not just
from Content API keys. The addition of a Content API specific
authorization middleware is because:
1. content api should not authorize based on req.user
2. content api will need separate authorization than admin api
This commit is contained in:
Fabien O'Carroll 2018-11-07 17:29:40 +07:00
parent 7323258415
commit 2e922808e8
3 changed files with 12 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/server/services/auth/authenticate.js
View File

@ -103,7 +103,7 @@ const authenticate = {
// ### v2 API auth middleware
authenticateAdminAPI: [session.safeGetSession, session.getUser],
authenticateContentApiKey: apiKeyAuth.content.authenticateContentApiKey
authenticateContentApi: apiKeyAuth.content.authenticateContentApiKey
};
module.exports = authenticate;

10
core/server/services/auth/authorize.js
View File

@ -38,7 +38,15 @@ const authorize = {
},
authorizeAdminAPI: [session.ensureUser],
// used by API v2 endpoints
authorizeContentApi(req, res, next) {
const hasApiKey = req.api_key && req.api_key.id;
if (hasApiKey) {
return next();
} else {
return next(new common.errors.NoPermissionError({message: common.i18n.t('errors.middleware.auth.pleaseSignInOrAuthenticate')}));
}
},
requiresAuthorizedUserOrApiKey(req, res, next) {
const hasUser = req.user && req.user.id;
const hasApiKey = req.api_key && req.api_key.id;

4
core/server/web/api/v2/content/middleware.js
View File

@ -14,8 +14,8 @@ const shared = require('../../../shared');
* Authentication for public endpoints
*/
module.exports.authenticatePublic = [
auth.authenticate.authenticateContentApiKey,
auth.authorize.requiresAuthorizedUserOrApiKey,
auth.authenticate.authenticateContentApi,
auth.authorize.authorizeContentApi,
cors(),
shared.middlewares.urlRedirects.adminRedirect,
shared.middlewares.prettyUrls