openhim-core/lib/middleware/authorisation.js

The OpenHIM core application that provides logging and routing of http requests

var Q, SDC, application, atna, auditing, authoriseClient, authoriseIP, config, domain, genAuthAudit, himSourceID, logger, os, sdc, statsdServer, utils,
  indexOf = [].indexOf || function(item) { for (var i = 0, l = this.length; i < l; i++) { if (i in this && this[i] === item) return i; } return -1; };

Q = require("q");

logger = require("winston");

atna = require('atna-audit');

config = require('../config/config');

config.authentication = config.get('authentication');

utils = require('../utils');

auditing = require('../auditing');

statsdServer = config.get('statsd');

application = config.get('application');

himSourceID = config.get('auditing').auditEvents.auditSourceID;

SDC = require('statsd-client');

os = require('os');

domain = (os.hostname()) + "." + application.name + ".appMetrics";

sdc = new SDC(statsdServer);

genAuthAudit = function(remoteAddress) {
  var audit;
  audit = atna.nodeAuthentication(remoteAddress, himSourceID, os.hostname(), atna.OUTCOME_MINOR_FAILURE);
  audit = atna.wrapInSyslog(audit);
  return audit;
};

authoriseClient = function(channel, ctx) {
  var i, len, ref, ref1, role;
  if ((ctx.authenticated != null) && (channel.allow != null)) {
    if (ctx.authenticated.roles != null) {
      ref = channel.allow;
      for (i = 0, len = ref.length; i < len; i++) {
        role = ref[i];
        if (indexOf.call(ctx.authenticated.roles, role) >= 0) {
          return true;
        }
      }
    }
    if (ref1 = ctx.authenticated.clientID, indexOf.call(channel.allow, ref1) >= 0) {
      return true;
    }
  }
  return false;
};

authoriseIP = function(channel, ctx) {
  var ref, ref1;
  if (((ref = channel.whitelist) != null ? ref.length : void 0) > 0) {
    return ref1 = ctx.ip, indexOf.call(channel.whitelist, ref1) >= 0;
  } else {
    return true;
  }
};

exports.authorise = function(ctx, done) {
  var channel;
  channel = ctx.matchingChannel;
  if ((channel != null) && authoriseIP(channel, ctx) && (channel.authType === 'public' || authoriseClient(channel, ctx))) {
    ctx.authorisedChannel = channel;
    logger.info("The request, '" + ctx.request.path + "' is authorised to access " + ctx.authorisedChannel.name);
  } else {
    ctx.response.status = 401;
    if (config.authentication.enableBasicAuthentication) {
      ctx.set("WWW-Authenticate", "Basic");
    }
    logger.info("The request, '" + ctx.request.path + "', is not authorised to access any channels.");
    auditing.sendAuditEvent(genAuthAudit(ctx.ip), function() {
      return logger.debug('Processed nodeAuthentication audit');
    });
  }
  return done();
};

exports.koaMiddleware = function*(next) {
  var authorise, startTime;
  if (statsdServer.enabled) {
    startTime = new Date();
  }
  authorise = Q.denodeify(exports.authorise);
  (yield authorise(this));
  if (this.authorisedChannel != null) {
    if (statsdServer.enabled) {
      sdc.timing(domain + ".authorisationMiddleware", startTime);
    }
    return (yield next);
  }
};

if (process.env.NODE_ENV === "test") {
  exports.genAuthAudit = genAuthAudit;
}

//# sourceMappingURL=authorisation.js.map