mirror of
https://github.com/TryGhost/Ghost.git
synced 2024-12-21 01:41:46 +03:00
829e8ed010
- Having these as destructured from the same package is hindering refactoring now - Events should really only ever be used server-side - i18n should be a shared module for now so it can be used everywhere until we figure out something better - Having them seperate also allows us to lint them properly
36 lines
1.1 KiB
JavaScript
36 lines
1.1 KiB
JavaScript
const errors = require('@tryghost/errors');
|
|
const i18n = require('../../lib/common/i18n');
|
|
|
|
const authorize = {
|
|
authorizeContentApi(req, res, next) {
|
|
const hasApiKey = req.api_key && req.api_key.id;
|
|
const hasMember = req.member;
|
|
if (hasApiKey) {
|
|
return next();
|
|
}
|
|
if (hasMember) {
|
|
return next();
|
|
}
|
|
return next(new errors.NoPermissionError({
|
|
message: i18n.t('errors.middleware.auth.authorizationFailed'),
|
|
context: i18n.t('errors.middleware.auth.missingContentMemberOrIntegration')
|
|
}));
|
|
},
|
|
|
|
authorizeAdminApi(req, res, next) {
|
|
const hasUser = req.user && req.user.id;
|
|
const hasApiKey = req.api_key && req.api_key.id;
|
|
|
|
if (hasUser || hasApiKey) {
|
|
return next();
|
|
} else {
|
|
return next(new errors.NoPermissionError({
|
|
message: i18n.t('errors.middleware.auth.authorizationFailed'),
|
|
context: i18n.t('errors.middleware.auth.missingAdminUserOrIntegration')
|
|
}));
|
|
}
|
|
}
|
|
};
|
|
|
|
module.exports = authorize;
|