yf-fpm-server/lib/middleware/permission.js

yf fast-platform api server

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});

var _exception = require('../utils/exception.js');

var _lodash = require('lodash');

var _lodash2 = _interopRequireDefault(_lodash);

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

exports.default = async (ctx, next) => {
  let req = ctx.request;
  let path = req.url;

  if (path === '/api') {
    if (req.method !== 'POST') {
      ctx.fail(_exception.E.System.ONLY_POST_ALLOWED);
      return;
    }

    let postData = ctx.request.body;
    let apps = await ctx.fpm.getClients();
    if (!_lodash2.default.has(apps, postData.appkey)) {
      ctx.fail(_exception.E.System.AUTH_ERROR);
      return;
    }

    let appItem = apps[postData.appkey];
    if (appItem.approot) {
      let approot = appItem.approot;
      if (approot === '*') {
        await next();
        return;
      }
      let method = postData.method;

      let root = '^' + approot + '$';

      if (new RegExp(root).test(method)) {
        await next();
        return;
      }
    }

    ctx.fail(_exception.E.System.ROOT_ERROR);
    return;
  }
  await next();
};