expressa 2.0.5 → 2.0.7

package/auth/index.js

@@ -1,47 +1,50 @@
-const bcrypt = require('bcryptjs')
-const handler = require('./jwt')
-const util = require('../util')
-
-exports.createHash = function (password) {
-  const salt = bcrypt.genSaltSync(10)
-  return bcrypt.hashSync(password, salt)
-}
-
-exports.isValidPassword = function (password, hashedPassword) {
-  return bcrypt.compareSync(password, hashedPassword)
-}
-
-exports.doLogin = handler.doLogin
-
-exports.middleware = async function authMiddleware(req, res, next) {
-  req.query = req.query || {}
-  const token = req.query['token'] || req.headers['x-access-token']
-  delete req.query['token']
-  delete req.headers['x-access-token']
-  let payload
-  try {
-    payload = await handler.isLoggedIn(token, req.getSetting('jwt_secret'))
-  }
-  catch(e) {
-    req.uerror = e.message
-  }
-  if (payload) {
-    let user
-    try {
-      user = await req.db[payload.collection].get(payload._id)
-    } catch (e) {
-      req.uerror = 'user no longer exists'
-    }
-    if (user) {
-      if (req.getSetting('jwt_expire_on_password_change') && user.meta.password_last_updated_at !== payload.timestamp) {
-        req.uerror = 'jwt expired'
-      }
-      if (!req.uerror) {
-        req.uid = payload._id
-        req.ucollection = payload.collection
-        req.user = user
-      }
-    }
-  }
-  next()
-}
+const bcrypt = require('bcryptjs')
+const handler = require('./jwt')
+
+exports.isHashed = function (string) {
+  return string && string.length === 60 && string[0] === '$'
+}
+
+exports.createHash = function (password) {
+  const salt = bcrypt.genSaltSync(10)
+  return bcrypt.hashSync(password, salt)
+}
+
+exports.isValidPassword = function (password, hashedPassword) {
+  return bcrypt.compareSync(password, hashedPassword)
+}
+
+exports.doLogin = handler.doLogin
+
+exports.middleware = async function authMiddleware(req, res, next) {
+  req.query = req.query || {}
+  const token = req.query['token'] || req.headers['x-access-token']
+  delete req.query['token']
+  delete req.headers['x-access-token']
+  let payload
+  try {
+    payload = await handler.isLoggedIn(token, req.getSetting('jwt_secret'))
+  }
+  catch(e) {
+    req.uerror = e.message
+  }
+  if (payload) {
+    let user
+    try {
+      user = await req.db[payload.collection].get(payload._id)
+    } catch (e) {
+      req.uerror = 'user no longer exists'
+    }
+    if (user) {
+      if (req.getSetting('jwt_expire_on_password_change') && user.meta.password_last_updated_at !== payload.timestamp) {
+        req.uerror = 'jwt expired'
+      }
+      if (!req.uerror) {
+        req.uid = payload._id
+        req.ucollection = payload.collection
+        req.user = user
+      }
+    }
+  }
+  next()
+}

package/controllers/collections.js

@@ -14,13 +14,11 @@ async function validateDocumentOwner(req, doc) {
   if (!doc.meta.owner_collection) {
     throw new util.ApiError(417, 'no owner_collection for owner found')
   }
-  if (doc._id !== doc.meta.owner) {
+  if (!(doc._id === doc.meta.owner && req.params.collection === doc.meta.owner_collection)) {
     const count = await req.db[doc.meta.owner_collection].count({ _id: doc.meta.owner }, undefined, 1)
     if (!count) {
       throw new util.ApiError(417, 'invalid owner')
     }
-  } else if (req.params.collection !== doc.meta.owner_collection) {
-    throw new util.ApiError(417, 'invalid owner collection')
   }
 }
 

package/db/file.js

@@ -5,8 +5,6 @@ Store.prototype.allAsync = promisify(Store.prototype.all)
 Store.prototype.getAsync = promisify(Store.prototype.get)
 Store.prototype.saveAsync = promisify(Store.prototype.save)
 
-const sift = require('sift')
-
 const util = require('../util')
 
 module.exports = function (settings, collection) {
@@ -25,7 +23,7 @@ module.exports = function (settings, collection) {
       const arr = Object.keys(data).map(function (id) {
         return data[id]
       })
-      let matches = sift(query || {}, arr)
+      let matches = util.mongoSearch(arr, query)
       if (orderby) {
         matches = util.orderBy(matches, orderby)
       }
@@ -96,7 +94,7 @@ module.exports = function (settings, collection) {
     updateWithQuery: async function (query, update, options) {
       const data = await store.allAsync()
       const arr = Object.keys(data).map((id) => ({ _id: id, ...data[id]}) )
-      const matches = sift(query || {}, arr)
+      const matches = util.mongoSearch(arr, query)
       const promises = matches.map((doc) => {
         util.mongoUpdate(doc, update)
         return store.saveAsync(doc._id, doc)

package/db/memory.js

@@ -1,6 +1,4 @@
 /* eslint no-unused-vars: ["error", { "args": "none" }] */
-const sift = require('sift')
-
 const util = require('../util')
 
 module.exports = function (settings, collection) {
@@ -14,7 +12,7 @@ module.exports = function (settings, collection) {
     },
     find: async function (query, offset, limit, orderby, fields) {
       const arr = Object.values(store)
-      let matches = sift(query || {}, arr)
+      let matches = util.mongoSearch(arr, query)
       if (orderby) {
         matches = util.orderBy(matches, orderby)
       }
@@ -61,7 +59,7 @@ module.exports = function (settings, collection) {
     // https://docs.mongodb.com/manual/reference/method/db.collection.updateMany/
     updateWithQuery: async function (query, update, options) {
       const arr = Object.keys(store).map((id) => ({ _id: id, ...store[id]}) )
-      const matches = sift(query || {}, arr)
+      const matches = util.mongoSearch(arr, query)
       matches.forEach((doc) => {
         util.mongoUpdate(doc, update)
         store[doc._id] = doc

package/index.js

@@ -113,8 +113,6 @@ module.exports.api = function (settings) {
     get pgpool() {
       return util.getPgPool(router.settings.postgresql_uri)
     },
-    doLogin: auth.doLogin,
-    createHash: auth.createHash,
     ...util,
   }
   router.eventListeners = {}

package/listeners_users.js

@@ -13,7 +13,7 @@ module.exports = async function(api) {
         data.password = oldData.password // preserve password if not explicitly set
       }
     }
-    if (data.password && data.password.length !== 60 && data.password[0] !== '$') {
+    if (!auth.isHashed(data.password)) {
       debug('hashing and replacing password in the user document.')
       data.password = auth.createHash(data.password)
       data.meta.password_last_updated_at = new Date().toISOString()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expressa",
-  "version": "2.0.5",
+  "version": "2.0.7",
   "description": "API framework using JSON schemas",
   "main": "index.js",
   "repository": "https://github.com/thomas4019/expressa",

package/util.js

@@ -6,6 +6,8 @@ const pg = require('pg')
 const pgPools = {}
 const dot = require('dot-object')
 const mongoQuery = require('mongo-query')
+const sift = require('sift')
+const auth = require('./auth/index')
 const Ajv = require('ajv')
 const ajv = new Ajv({
   allErrors: true,
@@ -152,6 +154,10 @@ exports.mongoProject = function(record, projection) {
   return result
 }
 
+exports.mongoSearch = function(docs, query) {
+  return sift(query || {}, docs)
+}
+
 exports.mongoUpdate = function(doc, update) {
   return mongoQuery(doc, {}, update)
 }
@@ -423,3 +429,7 @@ exports.createPagePagination = function createPagePagination (pageData, page, pa
 exports.getDatabaseOffset = function getDatabaseOffset(page, itemsPerPage) {
   return (page - 1) * itemsPerPage
 }
+
+exports.createHash = auth.createHash
+exports.isHashed = auth.isHashed
+exports.doLogin = auth.doLogin