burdy/src/server/middleware/auth.middleware.js

Open Source Headless Platform

"use strict";
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.extractAuthToken = void 0;
const user_model_1 = __importDefault(require("../models/user.model"));
const jwt_1 = require("../common/jwt");
const typeorm_1 = require("typeorm");
const unauthorized_error_1 = __importDefault(require("../errors/unauthorized-error"));
const lodash_1 = __importDefault(require("lodash"));
const hooks_1 = __importDefault(require("../../shared/features/hooks"));
const forbidden_error_1 = __importDefault(require("../errors/forbidden-error"));
const extractAuthToken = (req) => {
    var _a;
    return (_a = req === null || req === void 0 ? void 0 : req.cookies) === null || _a === void 0 ? void 0 : _a.token;
};
exports.extractAuthToken = extractAuthToken;
const authMiddleware = (permissions = []) => (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
    var _a;
    try {
        const token = (0, exports.extractAuthToken)(req);
        const decoded = (0, jwt_1.verify)(token);
        const entityManager = (0, typeorm_1.getManager)();
        let user = yield hooks_1.default.applyFilters('auth/getUser', null, req);
        if (!user) {
            user = yield entityManager
                .getRepository(user_model_1.default)
                .createQueryBuilder('user')
                .innerJoinAndSelect('user.sessions', 'sessions')
                .leftJoinAndSelect('user.meta', 'meta')
                .leftJoinAndSelect('user.groups', 'groups')
                .where('sessions.id = :sessionId AND user.id = :userId', {
                sessionId: decoded.sessionId,
                userId: decoded.userId,
            })
                .getOne();
        }
        if (!user)
            throw new Error();
        const userPermissions = yield hooks_1.default.applyFilters('auth/permissions', lodash_1.default.flatMap((_a = user === null || user === void 0 ? void 0 : user.groups) !== null && _a !== void 0 ? _a : [], 'permissions'), user);
        const hasPermission = userPermissions.includes('all') ||
            permissions.every((permission) => userPermissions.includes(permission));
        const hasAccess = yield hooks_1.default.applyFilters('auth/hasPermission', hasPermission, user, req);
        if (!hasAccess)
            throw new forbidden_error_1.default('forbidden');
        req.data = {
            user,
            session: user.sessions.find((session) => session.id === decoded.sessionId),
        };
        return next();
    }
    catch (error) {
        if (error instanceof forbidden_error_1.default) {
            return next(error);
        }
        res.clearCookie('token');
        return next(new unauthorized_error_1.default('unauthorized'));
    }
});
exports.default = authMiddleware;