From b6e7ebb6caa416c0a565aac98408526b2cc7fe31 Mon Sep 17 00:00:00 2001 From: Tyler Renelle Date: Tue, 5 Feb 2013 21:28:05 -0500 Subject: [PATCH] proper accessControl testing of server routes, fix REST --- src/server/private.coffee | 1 + src/server/serverRoutes.coffee | 22 ++++++++++++---------- src/server/store.coffee | 14 +++++++------- 3 files changed, 20 insertions(+), 17 deletions(-) diff --git a/src/server/private.coffee b/src/server/private.coffee index ed73b3b468..eb22c87bb9 100644 --- a/src/server/private.coffee +++ b/src/server/private.coffee @@ -51,6 +51,7 @@ module.exports.routes = (expressApp) -> else model = req.getModel() userId = model.session.userId + req._isServer = true model.fetch "users.#{userId}", (err, user) -> model.ref '_user', "users.#{userId}" model.set('_user.balance', model.get('_user.balance')+5) diff --git a/src/server/serverRoutes.coffee b/src/server/serverRoutes.coffee index 0871499118..126720ef67 100644 --- a/src/server/serverRoutes.coffee +++ b/src/server/serverRoutes.coffee @@ -17,33 +17,33 @@ module.exports = (expressApp, root, derby) -> deprecatedMessage = 'This API is no longer supported, see https://github.com/lefnire/habitrpg/wiki/API for new protocol' expressApp.get '/:uid/up/:score?', (req, res) -> res.send(500, deprecatedMessage) expressApp.get '/:uid/down/:score?', (req, res) -> res.send(500, deprecatedMessage) - expressApp.post '/v1/users/:uid/tasks/:taskId/:direction', (req, res) -> res.send(500, deprecatedMessage) + expressApp.post '/users/:uid/tasks/:taskId/:direction', (req, res) -> res.send(500, deprecatedMessage) # ---------- v1 API ------------ ### - v1 API. Requires user-id and api_token, task-id, direction. Test with: - curl -X POST -H "Content-Type:application/json" -d '{"api_token":"{TOKEN}"}' localhost:3000/v1/users/{UID}/tasks/productivity/up + v1 API. Requires user-id and apiToken, task-id, direction. Test with: + curl -X POST -H "Content-Type:application/json" -d '{"apiToken":"{TOKEN}"}' localhost:3000/v1/users/{UID}/tasks/productivity/up ### - # TODO /v1/.. - expressApp.post '/users/:uid/tasks/:taskId/:direction', (req, res) -> + expressApp.post '/v1/users/:uid/tasks/:taskId/:direction', (req, res) -> {uid, taskId, direction} = req.params - {api_token, title, service, icon} = req.body + {apiToken, title, service, icon} = req.body console.log {params:req.params, body:req.body} if process.env.NODE_ENV == 'development' # Send error responses for improper API call - return res.send(500, 'request body "api_token" required') unless api_token + return res.send(500, 'request body "apiToken" required') unless apiToken return res.send(500, ':uid required') unless uid return res.send(500, ':taskId required') unless taskId return res.send(500, ":direction must be 'up' or 'down'") unless direction in ['up','down'] model = req.getModel() - model.fetch model.query('users').withIdAndToken(uid, api_token), (err, result) -> + req._isServer = true + model.fetch model.query('users').withIdAndToken(uid, apiToken), (err, result) -> return res.send(500, err) if err user = result.at(0) userObj = user.get() if _.isEmpty(userObj) - return res.send(500, "User with uid=#{uid}, token=#{api_token} not found. Make sure you're not using your username, but your User Id") + return res.send(500, "User with uid=#{uid}, token=#{apiToken} not found. Make sure you're not using your username, but your User Id") model.ref('_user', user) @@ -59,7 +59,9 @@ module.exports = (expressApp, root, derby) -> up: true down: true notes: "This task was created by a third-party service. Feel free to edit, it won't harm the connection to that service. Additionally, multiple services may piggy-back off this task." - } + }, (a,b,c) -> + console.log {a:a,b:b,c:c} + scoring.setModel(model) delta = scoring.score(taskId, direction) diff --git a/src/server/store.coffee b/src/server/store.coffee index f7090361db..4c051f95a8 100644 --- a/src/server/store.coffee +++ b/src/server/store.coffee @@ -17,7 +17,7 @@ userAccess = (store) -> #return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37 uid = arguments[0] next = arguments[arguments.length - 1] - next (uid is @session.userId) or @req._isServer + next (uid is @session.userId) or @session.req?._isServer store.writeAccess "*", "users.*", -> # captures, value, next) -> #return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37 @@ -30,7 +30,7 @@ userAccess = (store) -> return next(true) # Same session (user.id = this.session.userId) - if (uid is @session.userId) or @req._isServer + if (uid is @session.userId) or @session.req?._isServer return next(true) next(false) @@ -39,12 +39,12 @@ userAccess = (store) -> #return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37 oldBalance = @session.req._racerModel?.get("users.#{id}.balance") || 0 purchasingSomethingOnClient = newBalance < oldBalance - next(purchasingSomethingOnClient or @req._isServer) + next(purchasingSomethingOnClient or @session.req?._isServer) store.writeAccess "*", "users.*.flags.ads", -> # captures, value, next -> #return unless @session and @session.userId # https://github.com/codeparty/racer/issues/37 next = arguments[arguments.length - 1] - next(@req._isServer) + next(@session.req?._isServer) ### @@ -52,12 +52,12 @@ userAccess = (store) -> Get user with API token ### REST = (store) -> - store.query.expose "users", "withIdAndToken", (id, api_token) -> + store.query.expose "users", "withIdAndToken", (id, apiToken) -> @where("id").equals(id) - .where('preferences.api_token').equals(api_token) + .where('apiToken').equals(apiToken) .limit(1) - store.queryAccess "users", "withIdAndToken", (id, token, next) -> + store.queryAccess "users", "withIdAndToken", (id, apiToken, next) -> #return next(false) unless @session and @session.userId # https://github.com/codeparty/racer/issues/37 next(true) # only user has id & token