coco-the-bear-auth-sessiontoken/src/authorization.js

A route handler for CoCo The Bear that enforces session token authentication and authorization.

const ObjectID = require('mongodb').ObjectID;
const httpErrors = require('@dannybster/coco-the-bear-http-errors');

const {
  notFound,
  serviceUnavailable,
} = httpErrors;

function createAuthorizationDocument(req, res, next) {
  /* eslint-disable no-underscore-dangle */
  const authorizationDocument = {
    documentId: req.datasource.result._id,
    userId: req.user._id,
  };
  /* eslint-enable no-underscore-dangle */

  function emitAttemptingToCreateAuthorizationDocument() {
    req.events.emitter.emit('app-event', {
      message: 'Creating an authorization document. See the object for more info.',
      object: authorizationDocument,
    });
  }

  function createDocument() {
    function handleError(err) {
      const message = 'Error creating an authorization document. See the info object for more info.';
      const responseBody = { message: 'Error creating authorization document.' };
      const error = serviceUnavailable
        .createError(message, authorizationDocument, responseBody, err);
      next(error);
      req.events.emitter.emit('error', error);
    }

    function handleSuccess() {
      next();
      req.events.emitter.emit('app-event', {
        message: 'Authorization document successfully created. See the object for more info.',
        object: authorizationDocument,
      });
    }

    req
      .datasource
      .db
      .collection('authorizationDocuments')
      .insertOne(authorizationDocument, (err) => {
        if (err) {
          handleError(err);
        } else {
          handleSuccess();
        }
      });
  }

  emitAttemptingToCreateAuthorizationDocument();
  createDocument();
}

function authorizeRequest(req, res, next) {
  /* eslint-disable no-underscore-dangle */
  const userId = req.user._id;
  /* eslint-enable no-underscore-dangle */

  const authorizationDocument = {
    userId,
    documentId: new ObjectID(req.params.identifier),
  };


  req.events.emitter.emit('app-event', {
    message: 'Looking up an authorization document. See the object for more info.',
    object: authorizationDocument,
  });

  req
    .datasource
    .db
    .collection('authorizationDocuments')
    .findOne(authorizationDocument, (err, foundAuthorizationDocument) => {
      if (err) {
        const message = 'Error finding an authorization document. See the info object for more info.';
        const responseBody = { message: 'Error finding an authorization document.' };
        const error =
          notFound.createError(message, authorizationDocument, responseBody, err);

        next(error);
        req.events.emitter.emit('error', error);
      } else if (!foundAuthorizationDocument) {
        const message = 'Authorization document not found. See the info object for more info.';
        const responseBody = { message: `A document matching ${authorizationDocument.documentId.toString()} could not be found for the user ${userId}` };
        const error =
          notFound.createError(message, authorizationDocument, responseBody);

        next(error);
        req.events.emitter.emit('error', error);
      } else {
        next();
        req.events.emitter.emit('app-event', {
          message: 'Successfully found an authorization document. See the object for more info.',
          object: foundAuthorizationDocument,
        });
      }
    });
}

module.exports.authorizeRequest = authorizeRequest;
module.exports.createAuthorizationDocument = createAuthorizationDocument;