mirror of
https://github.com/TryGhost/Ghost.git
synced 2024-12-22 18:31:57 +03:00
3db102a776
* Added API Key auth middleware to v2 content API refs #9865 - add `auth.authenticate.authenticateContentApiKey` middleware - accepts `?key=` query param, sets `req.api_key` if it's a known Content API key - add `requiresAuthorizedUserOrApiKey` authorization middleware - passes if either `req.user` or `req.api_key` exists - update `authenticatePublic` middleware stack for v2 content routes * Fixed functional content api tests no-issue This fixes the functional content api tests so they use the content api auth. * Fixed context check and removed skip * Updated cors middleware for content api * Removed client_id from frame.context no-issue The v2 api doesn't have a notion of clients as we do not use oauth for it * Fixed tests for posts input serializer
64 lines
2.0 KiB
JavaScript
64 lines
2.0 KiB
JavaScript
const debug = require('ghost-ignition').debug('api:shared:http');
|
|
const shared = require('../shared');
|
|
const models = require('../../models');
|
|
|
|
const http = (apiImpl) => {
|
|
return (req, res, next) => {
|
|
debug('request');
|
|
|
|
const frame = new shared.Frame({
|
|
body: req.body,
|
|
file: req.file,
|
|
files: req.files,
|
|
query: req.query,
|
|
params: req.params,
|
|
user: req.user,
|
|
context: {
|
|
api_key_id: (req.api_key && req.api_key.id) ? req.api_key.id : null,
|
|
user: ((req.user && req.user.id) || (req.user && models.User.isExternalUser(req.user.id))) ? req.user.id : null
|
|
}
|
|
});
|
|
|
|
frame.configure({
|
|
options: apiImpl.options,
|
|
data: apiImpl.data
|
|
});
|
|
|
|
apiImpl(frame)
|
|
.then((result) => {
|
|
debug(result);
|
|
|
|
// CASE: api ctrl wants to handle the express response (e.g. streams)
|
|
if (typeof result === 'function') {
|
|
debug('ctrl function call');
|
|
return result(req, res, next);
|
|
}
|
|
|
|
let statusCode = 200;
|
|
if (typeof apiImpl.statusCode === 'function') {
|
|
statusCode = apiImpl.statusCode(result);
|
|
} else if (apiImpl.statusCode) {
|
|
statusCode = apiImpl.statusCode;
|
|
}
|
|
|
|
res.status(statusCode);
|
|
|
|
// CASE: generate headers based on the api ctrl configuration
|
|
res.set(shared.headers.get(result, apiImpl.headers));
|
|
|
|
if (apiImpl.response && apiImpl.response.format === 'plain') {
|
|
debug('plain text response');
|
|
return res.send(result);
|
|
}
|
|
|
|
debug('json response');
|
|
res.json(result || {});
|
|
})
|
|
.catch((err) => {
|
|
next(err);
|
|
});
|
|
};
|
|
};
|
|
|
|
module.exports = http;
|