auth 0.0.9 → 1.0.0

package/examples/pseudo-3.js

@@ -1,61 +0,0 @@
-var db;
-
-//how do we handle permissions for super users?
-//simple answer is - user permissions have root privileges - there's only ONE root
-//level, which is the user itself. a "super" tag maybe applied, but after that, privileges
-//
-
-var  user1 = user(),
-
-//user2 can be a registered user, or it can be a 
-//public user that's automatically logged in. This could be the 
-//default option.
-user2 = user();
-
-
-//this sort of thing isn't necessary since authentication would be bubbled
-//up to the top-most item. in which case, "comments", is owned by post. "Post" is owned
-//by user. The authentication would work as follows:
-//auth -> posts -> comments
-db.collection("post").owns("comments");
-
-
-//in this case, post is owned by community. HOWEVER, "post" can still be shared with
-//other users. this use case just follows a different authentication path.
-//auth -> community -> post -> comments
-//where the post looks to see if the community is its owner - in which case 
-//modifications can be made against the given post. Before that, community
-//checks if a user is the given owner. 
-//how do we give permissions for the owner of given community to make changes
-//to any post? We could modify the query such that if the owner is of the community,
-//q = { community: _id }, but if the owner is of the poist, then q = { u: u, p: p }
-//In other words, think of this as a faster method short of adding super users in each item which... fndskfsfklds
-db.collection("community").owns("post").owns("");
-
-
-//here's a different use case. This would require watching "repositories" for any
-//NEW repository that comes in, instead of one shot.
-db.collection("repositories").owns("repository");
-
-
-//1 queue job
-//2 check if u1 owns someId
-//3. add user2 under "owners" in the given item
-user1.shareItem("someId", user2, function() {
-	//on share
-});
-
-//1 add job that gets triggered when a new repository is inserted
-//2. follow step "shareItem" when a new item is added
-user1.shareCollection("repositories", user2, function() {
-
-});
-
-//takes permissions away from the given user
-user1.takeAwayItem("someId", user2);
-	//cron.addJob({ from: user1, update: { $set: permissions: [] }}, to: user2 })
-
-
-//takes away privileges for a particular user
-user1.takeAwayCollection("repositories", user2);	
-	//cron.removeJob({ from: user1, collection: "repositories", to: user2 })

package/lib/access.js

@@ -1,18 +0,0 @@
-
-var all = [];
-
-["GET", "POST", "PUT", "DELETE"].forEach(function(method) {
-	all.push(exports[method] = method);
-});
-
-//don't want the array to be altered
-exports.all = function(isSuper) {
-	var acc = all.concat();
-	if(isSuper) {
-		acc.push(exports.SUPER);
-	}
-	return acc;
-}
-
-//outside of all - must be manually set.
-exports.SUPER = "SUPER";

package/lib/http/middleware/index.js

@@ -1,31 +0,0 @@
-var vine = require("vine"),
-comerr = require("comerr");
-
-exports.plugin = function(auth) {
-
-	var Account = auth.Account;
-
-	return {
-		authCheckpoint: function(req, res, next) {
-			if(req.session.token) {
-				q = { token: req.session.token };
-			} else {
-				q = req.query.token || req.query.email ? req.query : req.body || req.query;
-			}
-
-			Account.login(q, function(err, account) {
-
-				if(err) {
-
-					if(/\.json$/.test(req.path)) return res.send(vine.error(new comerr.Unauthorized("you must be logged in to view this page")));
-					
-					return res.redirect("/login?redirect_to=" +  encodeURIComponent(req.originalUrl));
-					// return res.send(vine.error(err));
-				}
-				req.account = account;
-				next();
-			});
-		},
-		
-	}
-}

package/lib/http/routes/index.js

@@ -1,152 +0,0 @@
-var step = require("step"),
-vine = require("vine"),
-reqOutcome = require("./reqOutcome"),
-dust = require("dustjs-linkedin"),
-step = require("step"),
-fs = require("fs");
-
-exports.plugin = function(httpServer, emailer, auth, loader) {
-
-	var Account = auth.Account,
-	InvitedAccount = auth.InvitedAccount,
-	privateMode = loader.params("privateMode") || false,
-	domain = loader.params("domain"),
-	serviceName = loader.params("serviceName");
-
-	eval(dust.compile(fs.readFileSync(loader.params("http.validateEmailTpl"), "utf8"), "validateEmailTpl"));
-
-
-	function getToken(req, res, account, render, redirect) {
-		account.getMainToken(function(err, token) {
-
-			req.session.token = token.key;
-
-			if(!render) {
-				if(err) {
-					return res.send(vine.error(err));
-				} else {
-					var obj = account.toObject();
-					delete obj.password; //why is this still here??
-					obj.token = token;
-					res.send(vine.result(obj));
-				}
-				return;
-			}
-
-			if(err) return res.render(render, {
-				error: err.message
-			});
-
-
-			res.redirect(redirect || req.query.redirect_to || loader.params("http.loginRedirect") || "/");
-		});
-	}
-
-	httpServer.get("/account.json", auth.middleware.authCheckpoint, function(req, res) {
-		getToken(req, res, req.account);
-	});
-
-	httpServer.post("/account.json", function(req, res) {
-		Account.signup(req.body, function(err, account) {
-			if(err) return res.send(vine.error(err));
-			getToken(req, res, account);
-		})
-	})
-
-
-	httpServer.get("/login", function(req, res) {
-
-		if(!req.secure && req.headers["x-forwarded-proto"] != "https" && !/127.0.0.1|localhost/.test(String(req.headers.host)))  {
-			return res.redirect("https://" + (req.headers.host || loader.params("domain") || loader.params("http.host")) + req.url);
-		}
-
-		res.render("login", {
-			redirect_to: req.query.redirect_to
-		});
-	});
-
-	httpServer.get("/logout", function(req, res) {
-		delete req.session.token;
-		res.redirect("/login");
-	});
-
-	httpServer.post("/login", function(req, res) {
-		Account.login(req.body, reqOutcome(req, res, "login").success(function(acc) {
-			getToken(req, res, acc, "login");
-		}));
-	});
-
-	httpServer.get("/signup", function(req, res) {
-		res.render("signup");
-	});
-
-
-	httpServer.get("/validate_account", function(req, res) {
-		var on = reqOutcome(req, res, "validate_account");
-
-		step(
-			function() {
-				Account.findOne({ _id: req.query.account }, this);
-			},
-			on.success(function(account) {
-				if(!account) return on(new Error("account does not exist"));
-				// if(account.validated) return on(new Error("this account has already been validated"));
-			
-				if(account.validationKey != req.query.validationKey) return on(new Error("incorrect validation key"));
-				account.validatedAt = new Date();
-				account.validated = true;
-				account.save(this);
-				Account.emit("validated", account);
-			}),
-			on.success(function(account) {
-				res.render("validate_account", {
-					account: account
-				});
-			})
-		);
-	});
-
-	Account.on("signup", function(acc) {
-		step(
-			function() {
-				dust.render("validateEmailTpl", { validationKey: acc.validationKey, accountId: acc._id }, this);
-			},
-			function(err, tpl) {
-				if(err) return console.error(err);
-				var next = this;
-				console.log("sending validation email");
-				emailer.send({
-					to: acc.email,
-					subject: "Validate Account",
-					htmlBody: tpl
-				}, function(err) {
-					if(err) console.error(err)
-					next();
-				});
-
-			},
-			function() {
-
-			}
-		);
-	});
-
-
-	httpServer.post("/signup", function(req, res) {
-
-		console.log("signing up")
-		var on = reqOutcome(req, res, "signup");
-
-		/*if(privateMode && !req.body.referredBy) {
-			on(new Error("You cannot signup unless you've been invited by someone"));
-		}*/
-
-		Account.signup(req.body, reqOutcome(req, res, "signup").success(function(acc) {
-			getToken(req, res, acc, "signup", loader.params("http.signupRedirect"));
-		}));
-		
-	});
-
-
-	require("./lostPassword").plugin(Account, auth.LostPassword, httpServer, emailer, getToken, loader);
-}

package/lib/http/routes/lostPassword.js

@@ -1,121 +0,0 @@
-var vine = require("vine"),
-reqOutcome = require("./reqOutcome"),
-step = require("step"),
-dust = require("dustjs-linkedin"),
-fs = require("fs");
-
-exports.plugin = function(Account, LostPassword, httpServer, emailer, getToken, loader) {
-
-	if(!emailer) return;
-
-	//register the dust tpl ~ fugly >.>
-	eval(dust.compile(fs.readFileSync(loader.params("http.lostPasswordEmailTpl"), "utf8"), "lostPasswordEmailTpl"));
-
-
-	httpServer.get("/lost_password", function(req, res) {
-		res.render("lost_password");
-	});
-
-	httpServer.post("/lost_password", function(req, res) {
-		var on = reqOutcome(req, res, "lost_password");
-
-		step(
-			function() {
-				Account.findOne({ email: req.body.email }, this);
-			},
-			on.success(function(account) {
-				if(!account) return on(new Error("account does not exist"));
-				this.account = account;
-
-				var lostPassword = new LostPassword({ account: account._id });
-
-				lostPassword.save(this);
-			}),
-			on.success(function(lostPassword) {
-				var next = this;
-
-				dust.render("lostPasswordEmailTpl", { email: req.body.email, token: lostPassword._id }, this);
-
-			}),
-			on.success(function(tpl) {
-				var next = this;
-				emailer.send({
-					to: this.account.email,
-					subject: "Reset Password",
-					htmlBody: tpl
-				}, function(err) {
-					if(err) return on(new Error("Unable to send password recovery email"));
-					next();
-				})
-			}),
-			on.success(function() {
-				res.render("lost_password_sent", {
-					email: this.account.email
-				});
-			})
-		);
-	});
-
-	function lostPasswordExists(req, res, next) {
-		var on = reqOutcome(req, res, "lost_password");
-
-		step(
-			function() {
-				LostPassword.findOne({ _id: req.query.token || req.body.token }, this);
-			},
-			on.success(function(lostPassword) {
-				if(!lostPassword) {
-					return on(new Error("The reset password token does not exist."));
-				} else 
-				if(lostPassword.expiresAt.getTime() < Date.now()) {
-					lostPassword.remove();
-					return on(new Error("The reset password link has expired."));
-				}
-
-				req.lostPassword = lostPassword;
-				this();
-			}),
-			next
-		);
-	}
-
-	httpServer.get("/reset_password", lostPasswordExists, function(req, res) {
-		res.render("reset_password", {
-			token: req.query.token
-		});
-	});
-
-	httpServer.post("/reset_password", lostPasswordExists, function(req, res) {
-		var on = reqOutcome(req, res, "reset_password");
-
-		step(
-			function() {
-				if(req.body.password.length < 6) {
-					console.log(vine.error(new Error("password must be at least 6 characters")).data)
-
-					return on(new Error("password must be at least 6 characters"));
-				}
-
-				if(req.body.password != req.body.password2) {
-					return on(new Error("passwords don't match"));
-				}
-
-				this();
-			},
-			function() {
-				Account.findOne({ _id: req.lostPassword.account }, this);
-			},
-			on.success(function(account) {
-				if(!account) return on(new Error("account doesn't exist"));
-				account.password = req.body.password;
-				account.save(this);
-			}),
-			on.success(function(account) {
-
-				getToken(req, res, account, "reset_password");
-				// res.render("login", vine.message("Please re-login with your new password").data);
-				// req.lostPassword.remove();
-			})
-		);
-	});
-}

package/lib/http/routes/reqOutcome.js

@@ -1,10 +0,0 @@
-vine = require("vine"),
-outcome = require("outcome"),
-_ = require("underscore");
-
-module.exports = function(req, res, render) {
-	var on = outcome.error(function(err) {
-		res.render(render, _.extend(req.query, vine.error(err).data));
-	});
-	return on;
-}

package/lib/index.js

@@ -1,65 +0,0 @@
-var structr = require("structr"),
-ownableModel = require("./mixin/ownableModel"),
-Account = require("./models/account"),
-LostPassword = require("./models/lostPassword"),
-_ = require("underscore"),
-middleware = require("./http/middleware");
-
-
-var Auth = structr({
-
-	/**
-	 */
-
-	publicKeys: ["login", "signup"],
-
-	/**
-	 */
-
-	"__construct": function(options) {
-		this.connection = options.connection;
-		this.Account    = Account.model(options);
-		this.LostPassword = LostPassword.model(options.connection);
-		this.middleware = middleware.plugin(this);
-		this.ownable = function(schema) {
-			return ownableModel(schema, options.connection);
-		}
-	},
-
-	/**
-	 * logs the user in
-	 */
-
-	"login": function(credentials, callback) {
-		this.Account.login.apply(this.Account, arguments);
-	},
-
-	/**
-	 * signs a user up
-	 */
-
-	"signup": function() {
-		this.Account.signup.apply(this.Account, arguments);
-	}
-});
-
-exports.access  = require("./access");
-
-exports.connect = function(options) {
-	return new Auth(options);
-}
-
-
-exports.require = [["auth.middleware.*"], "emailer", "plugin-mongodb", "plugin-express"];
-exports.plugin = function(authMiddleware, emailer, mongodb, httpServer, loader) {
-
-
-	var auth = exports.connect(_.extend({
-		connection: mongodb
-	}, loader.params("auth")));
-
-
-	require("./http/routes").plugin(httpServer, emailer, auth, loader);
-
-	return auth;
-}

package/lib/mixin/ownableModel.js

@@ -1,118 +0,0 @@
-var _        = require("underscore"),
-access       = require("../access"),
-comerr       = require("comerr");
-
-
-
-
-
-module.exports = function(schema, connection) {
-
-	var Schema = connection.base.Schema,
-	ObjectId   = Schema.ObjectId;
-
-	var Owner = new Schema({
-		account: ObjectId,
-		access: [ String ]
-	});
-
-	var Account = connection.model("accounts").schema,
-	collectionName;
-
-	//add owners schema to the item
-	schema.add({
-		owners: [ Owner ],
-
-		//is the item visible to the public?
-		isPublic: { type: Boolean, default: false }
-	});
-
-	//add a method to all
-	schema.methods.fetchOwner = function(callback) {
-		var owner = _.find(this.owners, function(owner) {
-			return ~owner.access.indexOf(access.SUPER);
-		});
-		if(!owner) return callback(new Error("item doesn't have an owner"));
-		this.model("accounts").findOne({ _id: owner.account }, function(err, account) {
-			if(err) return callback(err);
-			if(!account) return callback(new comerr.NotFound("account does't exist"));
-			callback(err, account);
-		});
-	}
-
-
-	//plucks any access to shared 
-	schema.statics.revokeShared = function(account, callback) {
-		this.collection.update(account.ownQuery(), {$pull:{ owners:{ account: account._id }}}, { multi: true }, callback);
-	}
-
-	//model is needed to remove the item if the account is deleted.
-	//NOTE - database might not be present, so we just grab the name for reference 
-	//later on
-	schema.once("init", function(m) {
-		collectionName = m.collection.name;
-	});
-
-	//on remove, remove the item as well.
-	Account.pre("remove", function(next) {
-		if(!collectionName) {
-			console.warn("model is not provided with an ownable schema");
-			return next();
-		}
-
-		var model = this.model(collectionName), 
-		self = this;
-
-		//first remove ALL items that belong to this acocunt
-		model.collection.remove(this.ownQuery(access.SUPER), { multi: true }, function() {
-
-			//next, pluck ANY items that maybe associated with this account
-			model.revokeShared(self, function(){});
-		});
-		next();
-	});
-
-	schema.pre("save", function(next) {
-		if(!this._account) {
-			return next();
-		}
-
-		if(this.authorized([this.isNew ? access.POST : access.PUT])) {
-			next();
-		} else {
-			this._account.unauthorized(next);
-		}
-	});	
-
-	schema.methods.authorized = function(acc, callback) {
-
-		if(typeof access == "function") {
-			callback = null;
-			acc      = null;
-		}
-
-		if(!acc) {
-			acc = access.all();
-		}
-
-		var authorized = !this._account || this._account.authorized(this, acc);
-
-		return !callback ? authorized : callback(null, authorized);
-	}
-
-	var oldToJson = schema.methods.toJSON;
-
-	//lockdown serialization
-	schema.methods.toJSON = function() {
-
-		//locked down?
-		if(this.authorized([access.GET])) {
-			return this.toObject();
-		} else {
-			return { error: this._account.unauthorized().message };
-		}
-	}
-
-
-	return schema;
-}