@xeplr/base-apis 2.0.4 → 2.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/lib/remoteAuth.js +8 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -120,7 +120,7 @@ Why on by default: a service that forgot to configure auth used to boot clean, p
|
|
|
120
120
|
|---|---|
|
|
121
121
|
| path starts with a `publicPaths` entry | skipped |
|
|
122
122
|
| no `Bearer` token | 401 `No token provided` |
|
|
123
|
-
| auth answers `403` with `code` `DISABLED` or `
|
|
123
|
+
| auth answers `403` with `code` `DISABLED`, `HIDDEN` or `UNLICENSED` | 403 with that `code`: signed in, but not allowed this API (`UNLICENSED`: its module is not in the caller's licence) |
|
|
124
124
|
| auth answers 401 / other 403 | same status, `Invalid or expired token` |
|
|
125
125
|
| auth answers 200 **without** `state: 'enabled'` (an older auth, or an `endpoint` such as `/me` that only says who the caller is) | **503**: "did not say no" is not "said yes" |
|
|
126
126
|
| auth unreachable, times out (`timeoutMs`, 5000), answers anything else, or answers non-JSON | **503 `Authentication service unavailable` — never let through** |
|
package/lib/remoteAuth.js
CHANGED
|
@@ -34,6 +34,11 @@ var DEFAULT_CACHE_SECONDS = 5;
|
|
|
34
34
|
// closed after 5s is bad; failing closed after forever is an outage.
|
|
35
35
|
var DEFAULT_TIMEOUT_MS = 5000;
|
|
36
36
|
|
|
37
|
+
// The 403 codes auth gives for a signed-in caller this API is refused to. Any
|
|
38
|
+
// other 403 is a token problem. UNLICENSED: the API's module is not in the
|
|
39
|
+
// caller's licence (@xeplr/auth's licence.use).
|
|
40
|
+
var REFUSALS = ['DISABLED', 'HIDDEN', 'UNLICENSED'];
|
|
41
|
+
|
|
37
42
|
/**
|
|
38
43
|
* @param {object} config
|
|
39
44
|
* @param {string} config.url - base URL of the auth service, e.g.
|
|
@@ -125,9 +130,10 @@ function remoteAuth(config) {
|
|
|
125
130
|
var body = null;
|
|
126
131
|
try { body = await response.json(); } catch (err) { body = null; }
|
|
127
132
|
|
|
128
|
-
if (response.status === 403 && body && (body.code
|
|
133
|
+
if (response.status === 403 && body && REFUSALS.indexOf(body.code) !== -1) {
|
|
129
134
|
// Signed in, but not allowed this API. The code says which, so a UI can
|
|
130
|
-
// grey a disabled item out rather than treat it as missing
|
|
135
|
+
// grey a disabled item out rather than treat it as missing, and tell
|
|
136
|
+
// "not in your licence" from "not for your role".
|
|
131
137
|
return { kind: 'refused', newToken: newToken, body: { error: body.error || 'Access denied', code: body.code } };
|
|
132
138
|
}
|
|
133
139
|
|