expressa 2.0.12 → 2.0.13

package/.eslintrc.json

@@ -20,7 +20,7 @@
         "xdescribe": true
     },
     "parserOptions": {
-        "ecmaVersion": 2022
+        "ecmaVersion": 12
     },
     "env": {
         "es6": true,

package/auth/index.js

@@ -17,6 +17,32 @@ exports.isValidPassword = function (password, hashedPassword) {
 exports.doLogin = handler.doLogin
 
 exports.middleware = async function authMiddleware(req, res, next) {
+  const key = req.query['access_key'] || req.headers['x-access-key']
+  if (key) {
+    if (typeof key == 'string' && req.db['access_keys']) {
+      const accessKeys = await req.db['access_keys'].find({ key: { $eq: key } }, 0, 1)
+      if (accessKeys && accessKeys.length > 0) {
+        const accessKey = accessKeys[0]
+        // check if access key is still valid
+        if (accessKey.expires_at >= new Date().toISOString()) {
+          let user
+          try {
+            user = await req.db[accessKey.user_collection].get(accessKey.user_id)
+          } catch (e) {
+            req.uerror = 'user no longer exists'
+          }
+          if (user && !req.uerror) {
+            req.uid = user._id
+            req.ucollection = 'users'
+            req.user = user
+          }
+        }
+      }
+    } else {
+      console.error('Non-string access key sent')
+    }
+  }
+
   req.query = req.query || {}
   const token = req.query['token'] || req.headers['x-access-token']
   delete req.query['token']

package/index.js

@@ -183,7 +183,7 @@ module.exports.api = function (settings) {
   (async function setup() {
     await initCollections(router.db, router)
 
-    const modules = ['collections', 'core', 'logging', 'permissions']
+    const modules = ['collections', 'core', 'logging', 'permissions', 'access_keys']
     router.modules = {}
     for (const module of modules) {
       router.modules[module] = require(`./modules/${module}/${module}`)

package/modules/access_keys/access_keys.js

@@ -0,0 +1,33 @@
+exports.collections = function () {
+  const access_keys = {
+    _id: 'access_keys',
+    schema: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        user_collection: {
+          type: 'string'
+        },
+        user_id: {
+          type: 'string'
+        },
+        key: {
+          type: 'string',
+          description: 'randomly generated secret'
+        },
+        expires_at: {
+          type: 'string'
+        },
+      },
+      required: [
+        'user_id',
+        'key',
+        'expires_at',
+      ]
+    },
+    storage: 'file',
+    documentsHaveOwners: true
+  }
+
+  return [access_keys]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expressa",
-  "version": "2.0.12",
+  "version": "2.0.13",
   "description": "API framework using JSON schemas",
   "main": "index.js",
   "repository": "https://github.com/thomas4019/expressa",
@@ -17,7 +17,7 @@
     "jfs": "^0.3.0",
     "jsonwebtoken": "^9.0.0",
     "mongo-query": "^0.5.7",
-    "mongo-query-to-postgres-jsonb": "^0.2.16",
+    "mongo-query-to-postgres-jsonb": "^0.2.17",
     "mongo-querystring": "4.1.1",
     "mongodb": "^3.5.7",
     "on-finished": "^2.3.0",

package/test/0-install.js

@@ -21,7 +21,7 @@ describe('install flow', function () {
     await request(app)
       .post('/install')
       .send({
-        modules: ['collections', 'core', 'logging', 'permissions'],
+        modules: ['collections', 'core', 'logging', 'permissions', 'access_keys'],
         settings: {
           jwt_secret: 'testing 123',
           jwt_expire_on_password_change: true,

package/test/test.js

@@ -54,6 +54,20 @@ describe('General Tests:', () => {
       .expect(200)
   })
 
+  it('returns collections using a key', async function () {
+    const badKey = '123'
+    await request(app)
+      .get('/collection')
+      .set('x-access-key', badKey)
+      .expect(401)
+
+    const key = await testutils.getAccessKeyForUserWithPermissions(api, ['collection: view'])
+    await request(app)
+      .get('/collection')
+      .set('x-access-key', key)
+      .expect(200)
+  })
+
   it('Sets headers', async function () {
     const token = await testutils.getUserWithPermissions(api, ['collection: view'])
     const res = await request(app)

package/test/testutils.js

@@ -81,6 +81,54 @@ exports.getUserWithPermissions = async function(api, permissions) {
   user._id = loginRes.body.uid
   return loginRes.body.token
 }
+
+exports.getAccessKeyForUserWithPermissions = async function(api, permissions) {
+  const service = request(exports.app)
+  if (typeof permissions === 'string') {
+    permissions = [permissions]
+  }
+  permissions = permissions || []
+  const permissionsMap = {}
+  permissions.forEach(function (permission) {
+    permissionsMap[permission] = true
+  })
+
+  const randId = randomstring.generate(12)
+  const roleName = 'role' + randId
+  const role = {
+    _id: roleName,
+    permissions: permissionsMap
+  }
+
+  const roleRes = await service.post('/role')
+    .set('x-access-token', tokens.admin)
+    .send(role)
+    .expect(200)
+
+  const user = {
+    email: 'test' + randId + '@example.com',
+    password: '123',
+  }
+  const registerRes = await service.post('/users/register')
+    .send(user)
+    .expect(200)
+
+  const updateRes = await service.post(`/users/${registerRes.body.id}/update`)
+    .send({ $push: { roles: roleName } })
+    .set('x-access-token', tokens.admin)
+    .expect(200)
+
+  let accessKey = randomstring.generate(8)
+  await exports.api.db.access_keys.create({
+    user_collection: 'users',
+    user_id: registerRes.body.id,
+    key: accessKey,
+    expires_at: '2032-01-01T00:00:00'
+  })
+
+  return accessKey
+}
+
 exports.clone = util.clone
 exports.sleep = function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms))