@apolitical/server 2.4.0 → 2.4.2

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.2] - 2022-03-03
+### Bumped
+- Version number for testing
+
+## [2.4.1] - 2022-03-02
+### Changed
+- Update authorisation middleware to include req.user check in cases where we would like to protect endpoints
+
 ## [2.4.0] - 2022-02-22
 ### Added
 - User slug to error logs as metadata

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apolitical/server",
-  "version": "2.4.0",
+  "version": "2.4.2",
   "description": "Node.js module to encapsulate Apolitical's express server setup",
   "author": "Apolitical Group Limited <engineering@apolitical.co>",
   "license": "MIT",

package/src/config.js

@@ -3,7 +3,7 @@
 const { NODE_ENV, LOG_LEVEL } = process.env;
 
 const NAME = 'apolitical-server';
-const VERSION = '2.4.0';
+const VERSION = '2.4.2';
 const ADMIN_ROLE = 'administrator';
 
 module.exports = {

package/src/middlewares/authorisation.middleware.js

@@ -20,7 +20,9 @@ module.exports = ({ logger, serverError: { Forbidden }, config }) => {
       }
       // Check permissions and prevent unauthorised requests
       let unauthorised = false;
-      if (!allowNonAdmin && isNotAdmin && isNotMyselfSlug) {
+      if (!allowNonAdmin && !req.user) {
+        unauthorised = true;
+      } else if (!allowNonAdmin && isNotAdmin && isNotMyselfSlug) {
         unauthorised = true;
       } else if (!allowNonAdmin && isNotAdmin && !myselfSource) {
         unauthorised = true;