expressa 2.0.12 → 2.0.14

package/.eslintrc.json

@@ -20,7 +20,7 @@
         "xdescribe": true
     },
     "parserOptions": {
-        "ecmaVersion": 2022
+        "ecmaVersion": 12
     },
     "env": {
         "es6": true,

package/auth/index.js

@@ -17,6 +17,32 @@ exports.isValidPassword = function (password, hashedPassword) {
 exports.doLogin = handler.doLogin
 
 exports.middleware = async function authMiddleware(req, res, next) {
+  const key = req.query['access_key'] || req.headers['x-access-key']
+  if (key) {
+    if (typeof key == 'string' && req.db['access_keys']) {
+      const accessKeys = await req.db['access_keys'].find({ key: { $eq: key } }, 0, 1)
+      if (accessKeys && accessKeys.length > 0) {
+        const accessKey = accessKeys[0]
+        // check if access key is still valid
+        if (accessKey.expires_at >= new Date().toISOString()) {
+          let user
+          try {
+            user = await req.db[accessKey.user_collection].get(accessKey.user_id)
+          } catch (e) {
+            req.uerror = 'user no longer exists'
+          }
+          if (user && !req.uerror) {
+            req.uid = user._id
+            req.ucollection = 'users'
+            req.user = user
+          }
+        }
+      }
+    } else {
+      console.error('Non-string access key sent')
+    }
+  }
+
   req.query = req.query || {}
   const token = req.query['token'] || req.headers['x-access-token']
   delete req.query['token']

package/controllers/users.js

@@ -1,52 +1,52 @@
-const auth = require('../auth')
-const util = require('../util')
-const collectionsApi = require('./collections')
-const permissions = require('../middleware/permissions')
-
-exports.login = async (req, collection) => {
-  const password = req.body.password
-
-  if (typeof req.body.email !== 'string') {
-    throw new util.ApiError(400, 'email must be a string')
-  }
-
-  req.body.email = req.body.email.toLowerCase()
-
-  // check if user exists
-  const result = await req.db[collection].find({
-    email: req.body.email
-  })
-  if (result.length === 0) {
-    throw new util.ApiError(400, 'No ' + collection + ' found with this email.')
-  }
-  const user = result[0]
-  if (!auth.isValidPassword(password, user.password)) {
-    throw new util.ApiError(401, 'Incorrect password')
-  }
-  const jwt_options = req.settings.jwt_expires_in ? { expiresIn: req.settings.jwt_expires_in } : {}
-  const payload = auth.doLogin({
-    id: user._id,
-    collection,
-    timestamp: user.meta.password_last_updated_at,
-    jwt_secret: req.getSetting('jwt_secret'),
-    jwt_options
-  })
-  req.uid = user._id
-  req.ucollection = collection
-  req.user = user
-  await permissions.addRolePermissionsAsync(req)
-  payload.canUseAdmin = req.hasPermission('login to admin')
-  return payload
-}
-
-exports.register = function (req, collection) {
-  req.url = `/${collection}`
-  req.params.collection = collection
-  return collectionsApi.insert(req)
-}
-
-exports.getMe = function (req, collection) {
-  req.params.collection = collection
-  req.params.id = req.uid
-  return collectionsApi.getById(req)
-}
+const auth = require('../auth')
+const util = require('../util')
+const collectionsApi = require('./collections')
+const permissions = require('../middleware/permissions')
+
+exports.login = async (req, collection) => {
+  const password = req.body.password
+
+  if (typeof req.body.email !== 'string') {
+    throw new util.ApiError(400, 'email must be a string')
+  }
+
+  req.body.email = req.body.email.toLowerCase()
+
+  // check if user exists
+  const result = await req.db[collection].find({
+    email: req.body.email
+  })
+  if (result.length === 0) {
+    throw new util.ApiError(400, 'No ' + collection + ' found with this email.')
+  }
+  const user = result[0]
+  if (!auth.isValidPassword(password, user.password)) {
+    throw new util.ApiError(401, 'Incorrect password')
+  }
+  const jwt_options = req.settings.jwt_expires_in ? { expiresIn: req.settings.jwt_expires_in } : {}
+  const payload = auth.doLogin({
+    id: user._id,
+    collection,
+    timestamp: user.meta.password_last_updated_at,
+    jwt_secret: req.getSetting('jwt_secret'),
+    jwt_options
+  })
+  req.uid = user._id
+  req.ucollection = collection
+  req.user = user
+  await permissions.addRolePermissionsAsync(req)
+  payload.canUseAdmin = req.hasPermission('login to admin')
+  return payload
+}
+
+exports.register = function (req, collection) {
+  req.url = `/${collection}`
+  req.params.collection = collection
+  return collectionsApi.insert(req)
+}
+
+exports.getMe = function (req, collection) {
+  req.params.collection = collection
+  req.params.id = req.uid
+  return collectionsApi.getById(req)
+}

package/index.js

@@ -183,7 +183,7 @@ module.exports.api = function (settings) {
   (async function setup() {
     await initCollections(router.db, router)
 
-    const modules = ['collections', 'core', 'logging', 'permissions']
+    const modules = ['collections', 'core', 'logging', 'permissions', 'access_keys']
     router.modules = {}
     for (const module of modules) {
       router.modules[module] = require(`./modules/${module}/${module}`)

package/modules/access_keys/access_keys.js

@@ -0,0 +1,33 @@
+exports.collections = function () {
+  const access_keys = {
+    _id: 'access_keys',
+    schema: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        user_collection: {
+          type: 'string'
+        },
+        user_id: {
+          type: 'string'
+        },
+        key: {
+          type: 'string',
+          description: 'randomly generated secret'
+        },
+        expires_at: {
+          type: 'string'
+        },
+      },
+      required: [
+        'user_id',
+        'key',
+        'expires_at',
+      ]
+    },
+    storage: 'file',
+    documentsHaveOwners: true
+  }
+
+  return [access_keys]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expressa",
-  "version": "2.0.12",
+  "version": "2.0.14",
   "description": "API framework using JSON schemas",
   "main": "index.js",
   "repository": "https://github.com/thomas4019/expressa",
@@ -17,7 +17,7 @@
     "jfs": "^0.3.0",
     "jsonwebtoken": "^9.0.0",
     "mongo-query": "^0.5.7",
-    "mongo-query-to-postgres-jsonb": "^0.2.16",
+    "mongo-query-to-postgres-jsonb": "^0.2.17",
     "mongo-querystring": "4.1.1",
     "mongodb": "^3.5.7",
     "on-finished": "^2.3.0",

package/test/0-install.js

@@ -21,7 +21,7 @@ describe('install flow', function () {
     await request(app)
       .post('/install')
       .send({
-        modules: ['collections', 'core', 'logging', 'permissions'],
+        modules: ['collections', 'core', 'logging', 'permissions', 'access_keys'],
         settings: {
           jwt_secret: 'testing 123',
           jwt_expire_on_password_change: true,

package/test/test.js

@@ -54,6 +54,20 @@ describe('General Tests:', () => {
       .expect(200)
   })
 
+  it('returns collections using a key', async function () {
+    const badKey = '123'
+    await request(app)
+      .get('/collection')
+      .set('x-access-key', badKey)
+      .expect(401)
+
+    const key = await testutils.getAccessKeyForUserWithPermissions(api, ['collection: view'])
+    await request(app)
+      .get('/collection')
+      .set('x-access-key', key)
+      .expect(200)
+  })
+
   it('Sets headers', async function () {
     const token = await testutils.getUserWithPermissions(api, ['collection: view'])
     const res = await request(app)

package/test/testutils.js

@@ -81,6 +81,54 @@ exports.getUserWithPermissions = async function(api, permissions) {
   user._id = loginRes.body.uid
   return loginRes.body.token
 }
+
+exports.getAccessKeyForUserWithPermissions = async function(api, permissions) {
+  const service = request(exports.app)
+  if (typeof permissions === 'string') {
+    permissions = [permissions]
+  }
+  permissions = permissions || []
+  const permissionsMap = {}
+  permissions.forEach(function (permission) {
+    permissionsMap[permission] = true
+  })
+
+  const randId = randomstring.generate(12)
+  const roleName = 'role' + randId
+  const role = {
+    _id: roleName,
+    permissions: permissionsMap
+  }
+
+  const roleRes = await service.post('/role')
+    .set('x-access-token', tokens.admin)
+    .send(role)
+    .expect(200)
+
+  const user = {
+    email: 'test' + randId + '@example.com',
+    password: '123',
+  }
+  const registerRes = await service.post('/users/register')
+    .send(user)
+    .expect(200)
+
+  const updateRes = await service.post(`/users/${registerRes.body.id}/update`)
+    .send({ $push: { roles: roleName } })
+    .set('x-access-token', tokens.admin)
+    .expect(200)
+
+  let accessKey = randomstring.generate(8)
+  await exports.api.db.access_keys.create({
+    user_collection: 'users',
+    user_id: registerRes.body.id,
+    key: accessKey,
+    expires_at: '2032-01-01T00:00:00'
+  })
+
+  return accessKey
+}
+
 exports.clone = util.clone
 exports.sleep = function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms))

package/util.js

@@ -75,6 +75,8 @@ exports.getSchemaProperty = function(collection, path) {
   for (const part of parts) {
     if (obj.properties && obj.properties[part]) {
       obj = obj.properties[part]
+    } else if (obj.items && obj.items.properties && obj.items.properties[part]) {
+      obj = obj.items.properties[part]
     } else {
       return
     }