proper accessControl testing of server routes, fix REST

src/server/private.coffee

@@ -51,6 +51,7 @@ module.exports.routes = (expressApp) ->
       else
         model = req.getModel()
         userId = model.session.userId
+        req._isServer = true
         model.fetch "users.#{userId}", (err, user) ->
           model.ref '_user', "users.#{userId}"
           model.set('_user.balance', model.get('_user.balance')+5)

src/server/serverRoutes.coffee

@@ -17,33 +17,33 @@ module.exports = (expressApp, root, derby) ->
   deprecatedMessage = 'This API is no longer supported, see https://github.com/lefnire/habitrpg/wiki/API for new protocol'
   expressApp.get '/:uid/up/:score?', (req, res) -> res.send(500, deprecatedMessage)
   expressApp.get '/:uid/down/:score?', (req, res) -> res.send(500, deprecatedMessage)
-  expressApp.post '/v1/users/:uid/tasks/:taskId/:direction', (req, res) -> res.send(500, deprecatedMessage)
+  expressApp.post '/users/:uid/tasks/:taskId/:direction', (req, res) -> res.send(500, deprecatedMessage)
 
   # ---------- v1 API ------------
 
   ###
-    v1 API. Requires user-id and api_token, task-id, direction. Test with:
-    curl -X POST -H "Content-Type:application/json" -d '{"api_token":"{TOKEN}"}' localhost:3000/v1/users/{UID}/tasks/productivity/up
+    v1 API. Requires user-id and apiToken, task-id, direction. Test with:
+    curl -X POST -H "Content-Type:application/json" -d '{"apiToken":"{TOKEN}"}' localhost:3000/v1/users/{UID}/tasks/productivity/up
   ###
-  # TODO /v1/..
-  expressApp.post '/users/:uid/tasks/:taskId/:direction', (req, res) ->
+  expressApp.post '/v1/users/:uid/tasks/:taskId/:direction', (req, res) ->
     {uid, taskId, direction} = req.params
-    {api_token, title, service, icon} = req.body
+    {apiToken, title, service, icon} = req.body
     console.log {params:req.params, body:req.body} if process.env.NODE_ENV == 'development'
 
     # Send error responses for improper API call
-    return res.send(500, 'request body "api_token" required') unless api_token
+    return res.send(500, 'request body "apiToken" required') unless apiToken
     return res.send(500, ':uid required') unless uid
     return res.send(500, ':taskId required') unless taskId
     return res.send(500, ":direction must be 'up' or 'down'") unless direction in ['up','down']
 
     model = req.getModel()
-    model.fetch model.query('users').withIdAndToken(uid, api_token), (err, result) ->
+    req._isServer = true
+    model.fetch model.query('users').withIdAndToken(uid, apiToken), (err, result) ->
       return res.send(500, err) if err
       user = result.at(0)
       userObj = user.get()
       if _.isEmpty(userObj)
-        return res.send(500, "User with uid=#{uid}, token=#{api_token} not found. Make sure you're not using your username, but your User Id")
+        return res.send(500, "User with uid=#{uid}, token=#{apiToken} not found. Make sure you're not using your username, but your User Id")
        
       model.ref('_user', user)
       
@@ -59,7 +59,9 @@ module.exports = (expressApp, root, derby) ->
           up: true
           down: true
           notes: "This task was created by a third-party service. Feel free to edit, it won't harm the connection to that service. Additionally, multiple services may piggy-back off this task."
-        }
+        }, (a,b,c) ->
+          console.log {a:a,b:b,c:c}
+
 
       scoring.setModel(model)
       delta = scoring.score(taskId, direction)

src/server/store.coffee

@@ -17,7 +17,7 @@ userAccess = (store) ->
     #return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
     uid = arguments[0]
     next = arguments[arguments.length - 1]
-    next (uid is @session.userId) or @req._isServer
+    next (uid is @session.userId) or @session.req?._isServer
 
   store.writeAccess "*", "users.*", -> # captures, value, next) ->
     #return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
@@ -30,7 +30,7 @@ userAccess = (store) ->
       return next(true)
 
     # Same session (user.id = this.session.userId)
-    if (uid is @session.userId) or @req._isServer
+    if (uid is @session.userId) or @session.req?._isServer
       return next(true)
 
     next(false)
@@ -39,12 +39,12 @@ userAccess = (store) ->
     #return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
     oldBalance = @session.req._racerModel?.get("users.#{id}.balance") || 0
     purchasingSomethingOnClient = newBalance < oldBalance
-    next(purchasingSomethingOnClient or @req._isServer)
+    next(purchasingSomethingOnClient or @session.req?._isServer)
 
   store.writeAccess "*", "users.*.flags.ads", -> # captures, value, next ->
     #return  unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
     next = arguments[arguments.length - 1]
-    next(@req._isServer)
+    next(@session.req?._isServer)
 
 
 ###
@@ -52,12 +52,12 @@ userAccess = (store) ->
   Get user with API token
 ###
 REST = (store) ->
-  store.query.expose "users", "withIdAndToken", (id, api_token) ->
+  store.query.expose "users", "withIdAndToken", (id, apiToken) ->
     @where("id").equals(id)
-      .where('preferences.api_token').equals(api_token)
+      .where('apiToken').equals(apiToken)
       .limit(1)
 
-  store.queryAccess "users", "withIdAndToken", (id, token, next) ->
+  store.queryAccess "users", "withIdAndToken", (id, apiToken, next) ->
     #return next(false) unless @session and @session.userId # https://github.com/codeparty/racer/issues/37
     next(true) # only user has id & token