sudoxreboot/habitica
1
0
Fork 0
mirror of https://github.com/sudoxnym/habitica.git synced 2026-08-05 12:02:13 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fixing up permission system for API tokens & server-requests

Browse source
This commit is contained in:
Tyler Renelle 2013-02-05 21:09:09 -05:00
parent 7607d162f8
commit 3ff08a49d2
1 changed files with 35 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

66
src/server/store.coffee
View file

@ -4,19 +4,20 @@ Setup read / write access
###
module.exports.customAccessControl = (store) ->
userAccess(store)
partySystem(store)
REST(store)
# store.readPathAccess "users.*", () -> # captures, next
# next = arguments[arguments.length-1]
# return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
# return next(true)
###
General user access
###
userAccess = (store) ->
store.readPathAccess "users.*", -> # captures, next) ->
#return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
captures = arguments[0]
uid = arguments[0]
next = arguments[arguments.length - 1]
sameSession = captures is @session.userId
isServer = false #!this.req.socket; //TODO how to determine if request came from server, as in REST?
next sameSession or isServer
next (uid is @session.userId) or @req._isServer
store.writeAccess "*", "users.*", -> # captures, value, next) ->
#return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
@ -24,33 +25,33 @@ module.exports.customAccessControl = (store) ->
uid = captures.shift()
attrPath = captures.join('.') # new array shifted left, after shift() was run
# TODO the server can write to anything - aka, REST
#return next(true) if !this.req.socket;
# public access to users.*.party.invitation (TODO, lock down a bit more)
return next(true) if (attrPath == 'party.invitation')
if (attrPath == 'party.invitation')
return next(true)
# Same session (user.id = this.session.userId)
return next(true) if uid is @session.userId
if (uid is @session.userId) or @req._isServer
return next(true)
next(false)
# store.writeAccess "*", "users.*.balance", (id, newBalance, next) ->
# return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
# purchasingSomethingOnClient = newBalance < this.session.req._racerModel.get("users.#{id}.balance")
# isServer = not @req.socket
# next(purchasingSomethingOnClient or isServer)
store.writeAccess "*", "users.*.balance", (id, newBalance, next) ->
#return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
oldBalance = @session.req._racerModel?.get("users.#{id}.balance") || 0
purchasingSomethingOnClient = newBalance < oldBalance
next(purchasingSomethingOnClient or @req._isServer)
store.writeAccess "*", "users.*.flags.ads", -> # captures, value, next ->
#return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
next = arguments[arguments.length - 1]
isServer = not @req.socket
next(isServer)
next(@req._isServer)
###
Get user with API token
###
###
REST
Get user with API token
###
REST = (store) ->
store.query.expose "users", "withIdAndToken", (id, api_token) ->
@where("id").equals(id)
.where('preferences.api_token').equals(api_token)
@ -58,12 +59,13 @@ module.exports.customAccessControl = (store) ->
store.queryAccess "users", "withIdAndToken", (id, token, next) ->
#return next(false) unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
isServer = not @req.socket
next(isServer)
next(true) # only user has id & token
###
Party permissions
###
###
Party permissions
###
partySystem = (store) ->
store.query.expose "users", "party", (ids) ->
@where("id").within(ids)
.only('stats',
@ -83,7 +85,9 @@ module.exports.customAccessControl = (store) ->
next(true)
store.readPathAccess "parties.*", ->
arguments[arguments.length-1](true)
next = arguments[arguments.length-1]
next(true)
store.writeAccess "*", "parties.*", ->
arguments[arguments.length-1](true)
next = arguments[arguments.length-1]
next(true)