expressa 2.0.17 → 2.0.18

package/.circleci/config.yml

@@ -1,21 +1,21 @@
-version: 2
-jobs:
-  build:
-    docker:
-      - image: circleci/node:16.13.0
-    steps:
-      - checkout
-      - run:
-          name: set npm registry
-          command: 'npm config set registry https://registry.npmjs.org/'
-      - run:
-          name: install-npm
-          command: npm install
-      - run:
-          name: test
-          command: MOCHA_FILE=~/junit/mocha/results.xml npm run ci-test
-          when: always
-      - store_test_results:
-          path: ~/junit
-      - store_artifacts:
-          path: ~/junit
+version: 2
+jobs:
+  build:
+    docker:
+      - image: circleci/node:16.13.0
+    steps:
+      - checkout
+      - run:
+          name: set npm registry
+          command: 'npm config set registry https://registry.npmjs.org/'
+      - run:
+          name: install-npm
+          command: npm install
+      - run:
+          name: test
+          command: MOCHA_FILE=~/junit/mocha/results.xml npm run ci-test
+          when: always
+      - store_test_results:
+          path: ~/junit
+      - store_artifacts:
+          path: ~/junit

package/.eslintrc.json

@@ -1,29 +1,29 @@
-{
-    "extends": "eslint:recommended",
-    "ignorePatterns": ["node_modules", "modules/admin", "**/build/", "cypress"],
-    "rules": {
-        "no-var": "error",
-        "prefer-const": "error",
-        "no-console": ["error", { "allow": ["error"] }],
-        "semi": ["error", "never"],
-        "quotes": ["error", "single"],
-        "quote-props": ["error", "as-needed"],
-        "indent": ["error", 2, { "MemberExpression": 1 }],
-        "linebreak-style": ["error", "unix"]
-    },
-    "globals": {
-        "after": true,
-        "before": true,
-        "describe": true,
-        "it": true,
-        "xit": true,
-        "xdescribe": true
-    },
-    "parserOptions": {
-        "ecmaVersion": 12
-    },
-    "env": {
-        "es6": true,
-        "node": true
-    }
-}
+{
+    "extends": "eslint:recommended",
+    "ignorePatterns": ["node_modules", "modules/admin", "**/build/", "cypress"],
+    "rules": {
+        "no-var": "error",
+        "prefer-const": "error",
+        "no-console": ["error", { "allow": ["error"] }],
+        "semi": ["error", "never"],
+        "quotes": ["error", "single"],
+        "quote-props": ["error", "as-needed"],
+        "indent": ["error", 2, { "MemberExpression": 1 }],
+        "linebreak-style": ["error", "unix"]
+    },
+    "globals": {
+        "after": true,
+        "before": true,
+        "describe": true,
+        "it": true,
+        "xit": true,
+        "xdescribe": true
+    },
+    "parserOptions": {
+        "ecmaVersion": 12
+    },
+    "env": {
+        "es6": true,
+        "node": true
+    }
+}

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2017 Thomas Hansen
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2017 Thomas Hansen
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,137 +1,137 @@
-![](expressa.png)
-[![CircleCI](https://circleci.com/gh/thomas4019/expressa.svg?style=svg)](https://circleci.com/gh/thomas4019/expressa)
-
-## data-driven extendable API middleware for Node.js/Express
-
-Expressa makes it easy to create basic APIs by using [JSON schema](http://json-schema.org):
-
-* django-like __admin interface__ for creating collection-__REST__ endpoints and managing permissions 
-* collection schema's can be edited *and* added __through the admin interface__ 
-* re-use collection schema's in your frontend to generate forms
-* easily extendable so you can add complex features as well
-* define collections as [JSON schema](http://json-schema.org) instead of custom code
-* per-collection database storage: *MongoDB*, *PostgreSQL*, or *JSON-files* (useful for version control)
-
-> Best of all: it's just middleware, not a framework 
-
-* mix-and-mash: easily throw in other express middleware and endpoints 
-* decorate expressa-endpoints: add event listeners which stop/modify requests (responses)
-
---------------------------------
-
-## Getting Started
-
-It's very easy to install expressa in your project directory:
-
-    mkdir myapp
-    cd myapp
-    npm init
-    npm install expressa express
-
-Create a file `app.js` with the following code (or just copy the middle 3 lines into your existing express app)
-
-    var express = require('express');
-    var app = express();
-
-    var expressa = require('expressa');
-    app.use('/admin', expressa.admin({ apiurl: '/api/' }));
-    app.use('/api', expressa.api());
-
-    app.listen(3000, function () {
-      console.log('Example app listening on port 3000!');
-    });
-
-Now start the server by running `node --use-strict app.js` and navigate your browser to [http://localhost:3000/admin/](http://localhost:3000/admin/)
-
-## API endpoints
-
-Once you add a collections in the admin interface, every collection will have the following endpoints:
-
-| method | endpoint                                     | description  |
-|--------|----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| POST   | /users/login                                 | expects JSON in the message body. e.g. `{"email": "email@example.com", password: "<the password>"}                                                                                             |
-| GET    | /:collection                                 | get an array of all documents in a collection                                                                                                                                                  |
-| GET    | /:collection/:id                             | get a specific document                                                                                                                                                                        |
-| GET    | /:collection/?query={..}                     | get an array of documents matching the [mongo query](https://www.npmjs.com/package/mongo-query)                                            |
-| GET    | /:collection/?query={..}&limit=10&offset=10&orderby={"meta.created":1}  | same as previous, but with targeted output control and sorting |
-| GET    | /:collection/?query={..}&page=1&pageitems=10 | similar to previous, but with pagination support |
-| GET    | /:collection/?query={..}&page=1&pageitems=10&pagemetadisable=1 | same as previous but *slightly* faster and with less pagination detail |
-| GET    | /:collection/?query={..}&fields={..}         | the fields param can be used to do a mongo projection to request only specific fields |
-| GET    | /:collection/?fieldname=value                | get an array of documents matching with the specified values. See [node-mongo-querystring](https://github.com/Turistforeningen/node-mongo-querystring) for details.                            |
-| GET    | /:collection/schema                          | get the collection schema                                                                                                                                                                      |
-| POST   | /:collection/                                | create a new document, the message body should be the JSON document                                                                                                                            |
-| PUT    | /:collection/:id                             | replace the document with id. The message body should be the JSON document. If the _id in document is different (the old document _id is deleted and a new one with id is created.)            |
-| POST   | /:collection/:id/update                      | modify the document with id using a [mongo update query](https://docs.mongodb.com/manual/reference/method/db.collection.update/#update-parameter). The message body should be the update query |
-| DELETE | /:collection/:id                             | delete the document                                                                                                                                                                            |
-
-> Supported Data: Only standard JSON (strings, numbers, booleans, null) is supported. Dates can be stored as strings using [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601)
-
-## Documentation 
-
-* Requests
-    * [Querying](doc/querying.md)
-    * [Making authenticated requests](doc/authentication.md)
-    * [Pagination and sorting](doc/querying.md)
-* Collections
-    * [Automatic fields](doc/automatic-fields.md)
-* Server-side implementation
-    * [Modifying behavior using listeners](doc/listeners.md)
-    * [Adding custom endpoints](doc/custom-endpoints.md)
-    * [Accessing the database](doc/database.md)
-* Admin Panel
-    * [Relationships](doc/relationships.md)
-    * [Permissions](doc/permissions.md)
-    * [Uploading files](doc/uploading-files.md)
-* [Testing / CI integrating your expressa app](doc/testing.md)
-
-# Folder Structure
-The Expressa configuration is in a folder called "data" in your project. There is a subfolder for the collections that you choose to persist to disk. By default, the following will be added once you finish the installation.
-
-| folder     | purpose                                                                              |
-|------------|--------------------------------------------------------------------------------------|
-| data/settings   | Config file per environment. Can include custom variables specific to your project.  |
-| data/role       | List of roles in the permission system. Defaults to "Admin", "Anonymous" and "Authenticated".   |
-| data/collection | JSON Schemas and settings for each collection.                                       |
-
-Note: The files in these data folders are JSON so they can be manually updated or you can edit them in the Admin UI. Generally these files should be checked into version control.
-
-# Admin UI Examples/Screenshots
-* [Example: Creating a blog collection and post in the UI](doc/blogexample.md)
-* [Managing CRUD permissions in the UI](doc/permissions.md)
-
-## Expressa ecosystem
-* [expressa-folder](https://npmjs.org/package/expressa-folder) easily extend expressa collections with ORM-ish js-code (get.js/post.js/functions.js/etc) & setup sub-endpoints
-* [expressa-swagger](https://npmjs.org/package/expressa-swagger) middleware to generate online api documentation
-* [expressa-client](https://npmjs.org/package/expressa-client) middleware to generate browser REST-client (+nodejs client)
-* [expressa-cli](https://npmjs.org/package/expressa-cli) commandline interface for expressa 
-
-## Roadmap
-* Automatic GraphQL Support
-* JWT token expiration
-* Support cookie based authentication as well
-* File uploads
-
-## Alternatives
-Expressa is not primarily built for simple blog websites or mostly static content websites. For those a cms like Keystone.js and enduro.js could work or maybe you could build you site with a static site generator like Hugo. For database-driven websites that need a strong CRUD backend where you want a clear separation between the frontend and backend, expressa.js is a great choice.
-
-## Changelog
-
-| Version | Important Changes                                                  |
-|---------|--------------------------------------------------------------------|
-| 0.5.3   | Fixes bug in install where enforce permissions wasn't activated. Fixes CSV download. |
-| 0.5.2   | Fixes bug when installing super user in Admin tool |
-| 0.5.1   | Includes built Admin UI in npm package |
-| 0.5.0   | Migrates server to use async/await. New Admin UI built with Vue.js. Adds request-id headers |
-| 0.4.6   | Fix some errors in the install process when choosing to store users in mongo or postgres |
-| 0.4.5   | Security update |
-| 0.4.1   | db.create (postgres) now returns the id instead of the full document. |
-| 0.4.0   | Pagination now starts with page 1. Delete requests can no longer bypass rejections by listeners. Updated permission error codes/messages. Error responses now always json (with an "error" field explaining) PUT /collection/:id response changed to match POST /collection |
-| 0.3.3   | Fixes security vulnerability with the "edit own" permission and the :collection/:id/update endpoint. Update immediately. |
-| 0.3.2   | Pagination is now supported by specifying the "page" and "limit"   |
-| 0.3.1   | Makes "development" the default settings file instead of "production". Use NODE_ENV environmental variable to change this. To quickly migrate, just rename your settings file to "development".  |                                                       
-
-## Inspired by
-
-* [deployd](http://deployd.com/) (API design)
-* [Django](https://www.djangoproject.com/) (admin UI)
-* [Drupal](https://www.drupal.org/) (roles/permissions)
+![](expressa.png)
+[![CircleCI](https://circleci.com/gh/thomas4019/expressa.svg?style=svg)](https://circleci.com/gh/thomas4019/expressa)
+
+## data-driven extendable API middleware for Node.js/Express
+
+Expressa makes it easy to create basic APIs by using [JSON schema](http://json-schema.org):
+
+* django-like __admin interface__ for creating collection-__REST__ endpoints and managing permissions 
+* collection schema's can be edited *and* added __through the admin interface__ 
+* re-use collection schema's in your frontend to generate forms
+* easily extendable so you can add complex features as well
+* define collections as [JSON schema](http://json-schema.org) instead of custom code
+* per-collection database storage: *MongoDB*, *PostgreSQL*, or *JSON-files* (useful for version control)
+
+> Best of all: it's just middleware, not a framework 
+
+* mix-and-mash: easily throw in other express middleware and endpoints 
+* decorate expressa-endpoints: add event listeners which stop/modify requests (responses)
+
+--------------------------------
+
+## Getting Started
+
+It's very easy to install expressa in your project directory:
+
+    mkdir myapp
+    cd myapp
+    npm init
+    npm install expressa express
+
+Create a file `app.js` with the following code (or just copy the middle 3 lines into your existing express app)
+
+    var express = require('express');
+    var app = express();
+
+    var expressa = require('expressa');
+    app.use('/admin', expressa.admin({ apiurl: '/api/' }));
+    app.use('/api', expressa.api());
+
+    app.listen(3000, function () {
+      console.log('Example app listening on port 3000!');
+    });
+
+Now start the server by running `node --use-strict app.js` and navigate your browser to [http://localhost:3000/admin/](http://localhost:3000/admin/)
+
+## API endpoints
+
+Once you add a collections in the admin interface, every collection will have the following endpoints:
+
+| method | endpoint                                     | description  |
+|--------|----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| POST   | /users/login                                 | expects JSON in the message body. e.g. `{"email": "email@example.com", password: "<the password>"}                                                                                             |
+| GET    | /:collection                                 | get an array of all documents in a collection                                                                                                                                                  |
+| GET    | /:collection/:id                             | get a specific document                                                                                                                                                                        |
+| GET    | /:collection/?query={..}                     | get an array of documents matching the [mongo query](https://www.npmjs.com/package/mongo-query)                                            |
+| GET    | /:collection/?query={..}&limit=10&offset=10&orderby={"meta.created":1}  | same as previous, but with targeted output control and sorting |
+| GET    | /:collection/?query={..}&page=1&pageitems=10 | similar to previous, but with pagination support |
+| GET    | /:collection/?query={..}&page=1&pageitems=10&pagemetadisable=1 | same as previous but *slightly* faster and with less pagination detail |
+| GET    | /:collection/?query={..}&fields={..}         | the fields param can be used to do a mongo projection to request only specific fields |
+| GET    | /:collection/?fieldname=value                | get an array of documents matching with the specified values. See [node-mongo-querystring](https://github.com/Turistforeningen/node-mongo-querystring) for details.                            |
+| GET    | /:collection/schema                          | get the collection schema                                                                                                                                                                      |
+| POST   | /:collection/                                | create a new document, the message body should be the JSON document                                                                                                                            |
+| PUT    | /:collection/:id                             | replace the document with id. The message body should be the JSON document. If the _id in document is different (the old document _id is deleted and a new one with id is created.)            |
+| POST   | /:collection/:id/update                      | modify the document with id using a [mongo update query](https://docs.mongodb.com/manual/reference/method/db.collection.update/#update-parameter). The message body should be the update query |
+| DELETE | /:collection/:id                             | delete the document                                                                                                                                                                            |
+
+> Supported Data: Only standard JSON (strings, numbers, booleans, null) is supported. Dates can be stored as strings using [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601)
+
+## Documentation 
+
+* Requests
+    * [Querying](doc/querying.md)
+    * [Making authenticated requests](doc/authentication.md)
+    * [Pagination and sorting](doc/querying.md)
+* Collections
+    * [Automatic fields](doc/automatic-fields.md)
+* Server-side implementation
+    * [Modifying behavior using listeners](doc/listeners.md)
+    * [Adding custom endpoints](doc/custom-endpoints.md)
+    * [Accessing the database](doc/database.md)
+* Admin Panel
+    * [Relationships](doc/relationships.md)
+    * [Permissions](doc/permissions.md)
+    * [Uploading files](doc/uploading-files.md)
+* [Testing / CI integrating your expressa app](doc/testing.md)
+
+# Folder Structure
+The Expressa configuration is in a folder called "data" in your project. There is a subfolder for the collections that you choose to persist to disk. By default, the following will be added once you finish the installation.
+
+| folder     | purpose                                                                              |
+|------------|--------------------------------------------------------------------------------------|
+| data/settings   | Config file per environment. Can include custom variables specific to your project.  |
+| data/role       | List of roles in the permission system. Defaults to "Admin", "Anonymous" and "Authenticated".   |
+| data/collection | JSON Schemas and settings for each collection.                                       |
+
+Note: The files in these data folders are JSON so they can be manually updated or you can edit them in the Admin UI. Generally these files should be checked into version control.
+
+# Admin UI Examples/Screenshots
+* [Example: Creating a blog collection and post in the UI](doc/blogexample.md)
+* [Managing CRUD permissions in the UI](doc/permissions.md)
+
+## Expressa ecosystem
+* [expressa-folder](https://npmjs.org/package/expressa-folder) easily extend expressa collections with ORM-ish js-code (get.js/post.js/functions.js/etc) & setup sub-endpoints
+* [expressa-swagger](https://npmjs.org/package/expressa-swagger) middleware to generate online api documentation
+* [expressa-client](https://npmjs.org/package/expressa-client) middleware to generate browser REST-client (+nodejs client)
+* [expressa-cli](https://npmjs.org/package/expressa-cli) commandline interface for expressa 
+
+## Roadmap
+* Automatic GraphQL Support
+* JWT token expiration
+* Support cookie based authentication as well
+* File uploads
+
+## Alternatives
+Expressa is not primarily built for simple blog websites or mostly static content websites. For those a cms like Keystone.js and enduro.js could work or maybe you could build you site with a static site generator like Hugo. For database-driven websites that need a strong CRUD backend where you want a clear separation between the frontend and backend, expressa.js is a great choice.
+
+## Changelog
+
+| Version | Important Changes                                                  |
+|---------|--------------------------------------------------------------------|
+| 0.5.3   | Fixes bug in install where enforce permissions wasn't activated. Fixes CSV download. |
+| 0.5.2   | Fixes bug when installing super user in Admin tool |
+| 0.5.1   | Includes built Admin UI in npm package |
+| 0.5.0   | Migrates server to use async/await. New Admin UI built with Vue.js. Adds request-id headers |
+| 0.4.6   | Fix some errors in the install process when choosing to store users in mongo or postgres |
+| 0.4.5   | Security update |
+| 0.4.1   | db.create (postgres) now returns the id instead of the full document. |
+| 0.4.0   | Pagination now starts with page 1. Delete requests can no longer bypass rejections by listeners. Updated permission error codes/messages. Error responses now always json (with an "error" field explaining) PUT /collection/:id response changed to match POST /collection |
+| 0.3.3   | Fixes security vulnerability with the "edit own" permission and the :collection/:id/update endpoint. Update immediately. |
+| 0.3.2   | Pagination is now supported by specifying the "page" and "limit"   |
+| 0.3.1   | Makes "development" the default settings file instead of "production". Use NODE_ENV environmental variable to change this. To quickly migrate, just rename your settings file to "development".  |                                                       
+
+## Inspired by
+
+* [deployd](http://deployd.com/) (API design)
+* [Django](https://www.djangoproject.com/) (admin UI)
+* [Drupal](https://www.drupal.org/) (roles/permissions)

package/auth/index.js

@@ -1,76 +1,76 @@
-const bcrypt = require('bcryptjs')
-const handler = require('./jwt')
-
-exports.isHashed = function (string) {
-  return string && string.length === 60 && string[0] === '$'
-}
-
-exports.createHash = function (password) {
-  const salt = bcrypt.genSaltSync(10)
-  return bcrypt.hashSync(password, salt)
-}
-
-exports.isValidPassword = function (password, hashedPassword) {
-  return bcrypt.compareSync(password, hashedPassword)
-}
-
-exports.doLogin = handler.doLogin
-
-exports.middleware = async function authMiddleware(req, res, next) {
-  const key = req.query['access_key'] || req.headers['x-access-key']
-  if (key) {
-    if (typeof key == 'string' && req.db['access_keys']) {
-      const accessKeys = await req.db['access_keys'].find({ key: { $eq: key } }, 0, 1)
-      if (accessKeys && accessKeys.length > 0) {
-        const accessKey = accessKeys[0]
-        // check if access key is still valid
-        if (accessKey.expires_at >= new Date().toISOString()) {
-          let user
-          try {
-            user = await req.db[accessKey.user_collection].get(accessKey.user_id)
-          } catch (e) {
-            req.uerror = 'user no longer exists'
-          }
-          if (user && !req.uerror) {
-            req.uid = user._id
-            req.ucollection = 'users'
-            req.user = user
-          }
-        }
-      }
-    } else {
-      console.error('Non-string access key sent')
-    }
-  }
-
-  req.query = req.query || {}
-  const token = req.query['token'] || req.headers['x-access-token']
-  delete req.query['token']
-  delete req.headers['x-access-token']
-  let payload
-  try {
-    payload = await handler.isLoggedIn(token, req.getSetting('jwt_secret'))
-  }
-  catch(e) {
-    req.uerror = e.message
-  }
-  if (payload) {
-    let user
-    try {
-      user = await req.db[payload.collection].get(payload._id)
-    } catch (e) {
-      req.uerror = 'user no longer exists'
-    }
-    if (user) {
-      if (req.getSetting('jwt_expire_on_password_change') && user.meta.password_last_updated_at !== payload.timestamp) {
-        req.uerror = 'jwt expired'
-      }
-      if (!req.uerror) {
-        req.uid = payload._id
-        req.ucollection = payload.collection
-        req.user = user
-      }
-    }
-  }
-  next()
-}
+const bcrypt = require('bcryptjs')
+const handler = require('./jwt')
+
+exports.isHashed = function (string) {
+  return string && string.length === 60 && string[0] === '$'
+}
+
+exports.createHash = function (password) {
+  const salt = bcrypt.genSaltSync(10)
+  return bcrypt.hashSync(password, salt)
+}
+
+exports.isValidPassword = function (password, hashedPassword) {
+  return bcrypt.compareSync(password, hashedPassword)
+}
+
+exports.doLogin = handler.doLogin
+
+exports.middleware = async function authMiddleware(req, res, next) {
+  const key = req.query['access_key'] || req.headers['x-access-key']
+  if (key) {
+    if (typeof key == 'string' && req.db['access_keys']) {
+      const accessKeys = await req.db['access_keys'].find({ key: { $eq: key } }, 0, 1)
+      if (accessKeys && accessKeys.length > 0) {
+        const accessKey = accessKeys[0]
+        // check if access key is still valid
+        if (accessKey.expires_at >= new Date().toISOString()) {
+          let user
+          try {
+            user = await req.db[accessKey.user_collection].get(accessKey.user_id)
+          } catch (e) {
+            req.uerror = 'user no longer exists'
+          }
+          if (user && !req.uerror) {
+            req.uid = user._id
+            req.ucollection = 'users'
+            req.user = user
+          }
+        }
+      }
+    } else {
+      console.error('Non-string access key sent')
+    }
+  }
+
+  req.query = req.query || {}
+  const token = req.query['token'] || req.headers['x-access-token']
+  delete req.query['token']
+  delete req.headers['x-access-token']
+  let payload
+  try {
+    payload = await handler.isLoggedIn(token, req.getSetting('jwt_secret'))
+  }
+  catch(e) {
+    req.uerror = e.message
+  }
+  if (payload) {
+    let user
+    try {
+      user = await req.db[payload.collection].get(payload._id)
+    } catch (e) {
+      req.uerror = 'user no longer exists'
+    }
+    if (user) {
+      if (req.getSetting('jwt_expire_on_password_change') && user.meta.password_last_updated_at !== payload.timestamp) {
+        req.uerror = 'jwt expired'
+      }
+      if (!req.uerror) {
+        req.uid = payload._id
+        req.ucollection = payload.collection
+        req.user = user
+      }
+    }
+  }
+  next()
+}

package/auth/jwt.js

@@ -1,31 +1,31 @@
-const jwt = require('jsonwebtoken')
-
-const util = require('../util')
-
-// User document already validated, created, and saved to database
-// The id of that document is given.
-exports.doLogin = function ({ id, collection, timestamp, jwt_secret, jwt_options = {} }) {
-  if (!jwt_secret) {
-    throw new util.ApiError(500, 'missing jwt_secret')
-  }
-  const token = jwt.sign({
-    _id: id,
-    collection,
-    timestamp,
-  }, jwt_secret, jwt_options)
-  return {
-    token: token,
-    uid: id
-  }
-}
-
-// Returns the user id, or false if not logged in.
-exports.isLoggedIn = async function (token, jwt_secret) {
-  if (!jwt_secret) {
-    return false
-  }
-  if (token) {
-    return jwt.verify(token, jwt_secret)
-  }
-  return false
-}
+const jwt = require('jsonwebtoken')
+
+const util = require('../util')
+
+// User document already validated, created, and saved to database
+// The id of that document is given.
+exports.doLogin = function ({ id, collection, timestamp, jwt_secret, jwt_options = {} }) {
+  if (!jwt_secret) {
+    throw new util.ApiError(500, 'missing jwt_secret')
+  }
+  const token = jwt.sign({
+    _id: id,
+    collection,
+    timestamp,
+  }, jwt_secret, jwt_options)
+  return {
+    token: token,
+    uid: id
+  }
+}
+
+// Returns the user id, or false if not logged in.
+exports.isLoggedIn = async function (token, jwt_secret) {
+  if (!jwt_secret) {
+    return false
+  }
+  if (token) {
+    return jwt.verify(token, jwt_secret)
+  }
+  return false
+}