@go-mailer/jarvis 5.0.1 → 5.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/lib/middlewares/auth.js +2 -21
- package/package.json +1 -1
package/lib/middlewares/auth.js
CHANGED
|
@@ -50,12 +50,6 @@
|
|
|
50
50
|
}
|
|
51
51
|
};
|
|
52
52
|
|
|
53
|
-
const authenticateMembership = (tenant_id, memberships = []) => {
|
|
54
|
-
const membership = memberships.find((mbrship) => Number(mbrship.tenant_id) === Number(tenant_id));
|
|
55
|
-
if (!membership || membership.status !== "active") throw new Error("Unauthorized");
|
|
56
|
-
return tenant_id;
|
|
57
|
-
};
|
|
58
|
-
|
|
59
53
|
const authenticateParamKey = async (request, response, next) => {
|
|
60
54
|
try {
|
|
61
55
|
const { api_key: token } = request.params;
|
|
@@ -67,18 +61,6 @@
|
|
|
67
61
|
}
|
|
68
62
|
};
|
|
69
63
|
|
|
70
|
-
const authenticateTenant = async (request, response, next) => {
|
|
71
|
-
try {
|
|
72
|
-
const tenant_id = extractId(request, "tenant_id");
|
|
73
|
-
request.tenant_id = request.is_admin ? tenant_id : authenticateMembership(tenant_id, request.memberships || []);
|
|
74
|
-
|
|
75
|
-
next();
|
|
76
|
-
} catch (e) {
|
|
77
|
-
authLogger.error(e, "authenticateUser");
|
|
78
|
-
return response.status(403).json(Errors.UNAUTHORIZED);
|
|
79
|
-
}
|
|
80
|
-
};
|
|
81
|
-
|
|
82
64
|
const authenticateUser = async (request, response, next) => {
|
|
83
65
|
try {
|
|
84
66
|
// env vars
|
|
@@ -96,10 +78,10 @@
|
|
|
96
78
|
return next();
|
|
97
79
|
}
|
|
98
80
|
|
|
99
|
-
const { id: user_id, is_admin,
|
|
81
|
+
const { id: user_id, is_admin, tenant_id } = await jwt.verify(token, SECRET, { issuer: ISSUER });
|
|
100
82
|
request.is_admin = !!is_admin;
|
|
101
83
|
request.user_id = is_admin ? extractId(request, "user_id") : user_id;
|
|
102
|
-
request.
|
|
84
|
+
request.tenant_id = is_admin ? extractId(request, "tenant_id") : tenant_id;
|
|
103
85
|
|
|
104
86
|
next();
|
|
105
87
|
} catch (e) {
|
|
@@ -112,7 +94,6 @@
|
|
|
112
94
|
authenticateAdmin,
|
|
113
95
|
authenticateBearerKey,
|
|
114
96
|
authenticateParamKey,
|
|
115
|
-
authenticateTenant,
|
|
116
97
|
authenticateUser,
|
|
117
98
|
};
|
|
118
99
|
|