burdy/src/server/middleware/content.middleware.js

Open Source Headless Platform

"use strict";
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
    return new (P || (P = Promise))(function (resolve, reject) {
        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
        step((generator = generator.apply(thisArg, _arguments || [])).next());
    });
};
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.extractContentToken = exports.verifyContentToken = void 0;
const typeorm_1 = require("typeorm");
const unauthorized_error_1 = __importDefault(require("../errors/unauthorized-error"));
const forbidden_error_1 = __importDefault(require("../errors/forbidden-error"));
const access_token_1 = __importDefault(require("../models/access-token"));
const site_settings_model_1 = __importDefault(require("../models/site-settings.model"));
const verifyContentToken = ({ token, entityManager, }) => __awaiter(void 0, void 0, void 0, function* () {
    const accessToken = yield entityManager.getRepository(access_token_1.default).findOne({
        where: {
            token,
        },
    });
    if (!accessToken)
        throw new unauthorized_error_1.default('unauthorized');
});
exports.verifyContentToken = verifyContentToken;
const extractContentToken = (req) => {
    var _a, _b;
    return ((_a = req === null || req === void 0 ? void 0 : req.headers) === null || _a === void 0 ? void 0 : _a['x-content-token']) || ((_b = req === null || req === void 0 ? void 0 : req.query) === null || _b === void 0 ? void 0 : _b['x-content-token']);
};
exports.extractContentToken = extractContentToken;
const contentMiddleware = (options) => (req, res, next) => __awaiter(void 0, void 0, void 0, function* () {
    try {
        const entityManager = (0, typeorm_1.getManager)();
        const token = (0, exports.extractContentToken)(req);
        if (options === null || options === void 0 ? void 0 : options.alwaysAuthorize) {
            yield (0, exports.verifyContentToken)({
                token,
                entityManager,
            });
        }
        else {
            const apiAccess = yield entityManager
                .getRepository(site_settings_model_1.default)
                .findOne({
                where: {
                    key: 'apiAccess',
                },
            });
            if ((apiAccess === null || apiAccess === void 0 ? void 0 : apiAccess.value) === 'private')
                yield (0, exports.verifyContentToken)({
                    token,
                    entityManager,
                });
        }
        return next();
    }
    catch (error) {
        if (error instanceof forbidden_error_1.default) {
            return next(error);
        }
        return next(new unauthorized_error_1.default('unauthorized'));
    }
});
exports.default = contentMiddleware;