Use token authentication for API requests.

lib/auth.js

@@ -1,9 +1,49 @@
 import { parse } from 'cookie';
-import { parseSecureToken } from './crypto';
+import { parseSecureToken, parseToken } from './crypto';
 import { AUTH_COOKIE_NAME } from './constants';
+import { getWebsiteById } from './queries';
 
-export async function verifyAuthToken(req) {
+export async function getAuthToken(req) {
   const token = parse(req.headers.cookie || '')[AUTH_COOKIE_NAME];
 
   return parseSecureToken(token);
 }
+
+export async function isValidToken(token, validation) {
+  try {
+    const result = await parseToken(token);
+
+    if (typeof validation === 'object') {
+      return !Object.keys(validation).find(key => result[key] !== validation[key]);
+    } else if (typeof validation === 'function') {
+      return validation(result);
+    }
+  } catch (e) {
+    return false;
+  }
+
+  return false;
+}
+
+export async function allowQuery(req, skipToken) {
+  const { id, token } = req.query;
+  const websiteId = +id;
+
+  const website = await getWebsiteById(websiteId);
+
+  if (website) {
+    if (token && !skipToken) {
+      return isValidToken(token, { website_id: websiteId });
+    }
+
+    const authToken = await getAuthToken(req);
+
+    if (authToken) {
+      const { user_id, is_admin } = authToken;
+
+      return is_admin || website.user_id === user_id;
+    }
+  }
+
+  return false;
+}

lib/crypto.js

@@ -27,7 +27,7 @@ export function uuid(...args) {
   return v5(args.join(''), salt());
 }
 
-export function isValidId(s) {
+export function isValidUuid(s) {
   return validate(s);
 }
 

lib/middleware.js

@@ -1,6 +1,6 @@
 import cors from 'cors';
-import { verifySession } from './session';
-import { verifyAuthToken } from './auth';
+import { getSession } from './session';
+import { getAuthToken } from './auth';
 import { unauthorized, badRequest, serverError } from './response';
 
 export function use(middleware) {
@@ -21,7 +21,7 @@ export const useSession = use(async (req, res, next) => {
   let session;
 
   try {
-    session = await verifySession(req);
+    session = await getSession(req);
   } catch (e) {
     return serverError(res, e.message);
   }
@@ -35,13 +35,7 @@ export const useSession = use(async (req, res, next) => {
 });
 
 export const useAuth = use(async (req, res, next) => {
-  let token;
-
-  try {
-    token = await verifyAuthToken(req);
-  } catch (e) {
-    return serverError(res, e.message);
-  }
+  const token = await getAuthToken(req);
 
   if (!token) {
     return unauthorized(res);

lib/session.js

@@ -1,8 +1,8 @@
 import { getWebsiteByUuid, getSessionByUuid, createSession } from 'lib/queries';
 import { getClientInfo } from 'lib/request';
-import { uuid, isValidId } from 'lib/crypto';
+import { uuid, isValidUuid } from 'lib/crypto';
 
-export async function verifySession(req) {
+export async function getSession(req) {
   const { payload } = req.body;
 
   if (!payload) {
@@ -11,7 +11,7 @@ export async function verifySession(req) {
 
   const { website: website_uuid, hostname, screen, language } = payload;
 
-  if (!isValidId(website_uuid)) {
+  if (!isValidUuid(website_uuid)) {
     throw new Error(`Invalid website: ${website_uuid}`);
   }