sheercms/lib/auth.js

Sheer Cliff CMS is a simple and powerful content management system (CMS) for Node JS.

var jwt = require('jwt-simple');
var path = require('path');
var config = require('./config');
var logger = require('./logger');
var api = require('./api');
var utils = require('./utilities');

module.exports.authenticate = function(req, res, next) {
    auth(req, res, next, false);
};

module.exports.authenticateAdmin = function(req, res, next) {
    auth(req, res, next, true);
};

function auth(req, res, next, requireAdmin) {

    try {
        var token = (req.body && req.body.authtoken) ||
            (req.query && req.query.authtoken) ||
            req.headers['x-auth-token'] ||
            (req.cookies && req.cookies[config.settings.cms_token_cookie]);

        if (token) {
            try {
                var decoded = jwt.decode(token, config.settings.token_secret);
                if (decoded.exp <= Date.now()) {
                    logger.info('auth.authenticate: Access token has expired.');
                    res.redirect('/cms/login?reason=expired');
                }
                else {
                    var username = decoded.id;
                    //lookup the user
                    api.users.getUser(username, function(err, user) {
                        if (err) {
                            res.redirect('/cms/login');
                        }
                        else if (user) {
                            if (requireAdmin === true && api.users.isAdmin(user) !== true) {
                                logger.warn('auth.authenticate: Unauthorized access by user to URL: username=' + user.username + '; url=' + req.url);
                                req.user = user;
                                res.send(403, "Access denied");
                            }
                            else if (api.users.isCMSUser(user) || api.users.isAdmin(user)) {
                                logger.info('auth.authenticate: Checking token...found account: ' + user.username);
                                req.user = user;
                                next();
                            }
                            else {
                                logger.warn('auth.authenticate: User role not allowed to access this resource. Username: ' + username);
                                res.redirect('/cms/login');
                            }
                        }
                        else {
                            logger.info('auth.authenticate: Checking token...account not found: ' + username);
                            res.redirect('/cms/login');
                        }

                    });
                }
            }
            catch (err) {
                logger.error("auth.authenticate: Error decoding access token.");
                logger.error(err);
                res.redirect('/cms/login');
            }
        }
        else {
            logger.warn('auth.authenticate: Access token not found.');
            res.redirect('/cms/login');
        }
    }
    catch(e) {
        logger.error(e);
        res.send(500, "Error authenticating request.");
    }
};


module.exports.loadUser = function(req, res, next) {

    try {
        var token = (req.body && req.body.authtoken) ||
            (req.query && req.query.authtoken) ||
            req.headers['x-auth-token'] ||
            (req.cookies && req.cookies[config.settings.cms_token_cookie]);

        if (token) {
            try {
                var decoded = jwt.decode(token, config.settings.token_secret);
                if (decoded.exp <= Date.now()) {
                    logger.info('Access token has expired.');
                    next();
                }
                else {
                    var username = decoded.id;
                    //lookup the user
                    api.users.getUser(username, function(err, user) {
                        if (err || !user) {
                            next();
                        }
                        else {
                            logger.info('Checking token...found account: ' + user.username);
                            req.user = user;
                            next();
                        }
                    });
                }
            } catch (err) {
                logger.error('Error decoding access token.');
                next();
            }
        } else {
            next();
        }
    }
    catch(e) {
        logger.error("Error loading the request user: " + e.stack);
        res.send(500, "Error loading the request user.");
    }
};