diff --git a/api-server/server/middlewares/jwt-authorizaion.test.js b/api-server/server/middlewares/jwt-authorizaion.test.js index 98b497f886..8374198fc5 100644 --- a/api-server/server/middlewares/jwt-authorizaion.test.js +++ b/api-server/server/middlewares/jwt-authorizaion.test.js @@ -1,3 +1,4 @@ +/* global describe xdescribe it expect */ import { isWhiteListedPath } from './jwt-authorization'; describe('jwt-authorization', () => { @@ -25,5 +26,5 @@ describe('jwt-authorization', () => { }); }); - xdescribe('authorizeByJWT') + xdescribe('authorizeByJWT'); }); diff --git a/api-server/server/middlewares/jwt-authorization.js b/api-server/server/middlewares/jwt-authorization.js index 5491cb68a2..06f88fed05 100644 --- a/api-server/server/middlewares/jwt-authorization.js +++ b/api-server/server/middlewares/jwt-authorization.js @@ -12,75 +12,69 @@ const apiProxyRE = /^\/internal\/|^\/external\//; const newsShortLinksRE = /^\/internal\/n\/|^\/internal\/p\?/; const loopbackAPIPathRE = /^\/internal\/api\//; -const _whiteListREs = [ - newsShortLinksRE, - loopbackAPIPathRE -]; +const _whiteListREs = [newsShortLinksRE, loopbackAPIPathRE]; -export function isWhiteListedPath(path, whiteListREs= _whiteListREs) { - return whiteListREs.some(re => re.test(path)) +export function isWhiteListedPath(path, whiteListREs = _whiteListREs) { + return whiteListREs.some(re => re.test(path)); } +export default () => + function authorizeByJWT(req, res, next) { + const { path } = req; + if (apiProxyRE.test(path) && !isWhiteListedPath(path)) { + const cookie = + (req.signedCookies && req.signedCookies['jwt_access_token']) || + (req.cookie && req.cookie['jwt_access_token']); -export default () => function authorizeByJWT(req, res, next) { - const { path } = req; - if (apiProxyRE.test(path) && !isWhiteListedPath(path)) { - const cookie = req.signedCookies && req.signedCookies['jwt_access_token'] || - req.cookie && req.cookie['jwt_access_token']; - - if (!cookie) { - throw wrapHandledError( - new Error('Access token is required for this request'), - { - type: 'info', - redirect: `${homeLocation}/signin`, - message: 'Access token is required for this request', - status: 403 - } - ); - } - let token; - try { - token = jwt.verify(cookie, process.env.JWT_SECRET); - } catch (err) { - throw wrapHandledError( - new Error(err.message), - { + if (!cookie) { + throw wrapHandledError( + new Error('Access token is required for this request'), + { + type: 'info', + redirect: `${homeLocation}/signin`, + message: 'Access token is required for this request', + status: 403 + } + ); + } + let token; + try { + token = jwt.verify(cookie, process.env.JWT_SECRET); + } catch (err) { + throw wrapHandledError(new Error(err.message), { type: 'info', redirect: `${homeLocation}/signin`, message: 'Your access token is invalid', status: 403 - } - ); - } - const { accessToken: {created, ttl, userId }} = token; - const valid = isBefore(Date.now(), Date.parse(created) + ttl); - if (!valid) { - throw wrapHandledError( - new Error('Access token is no longer vaild'), - { + }); + } + const { + accessToken: { created, ttl, userId } + } = token; + const valid = isBefore(Date.now(), Date.parse(created) + ttl); + if (!valid) { + throw wrapHandledError(new Error('Access token is no longer vaild'), { type: 'info', redirect: `${homeLocation}/signin`, message: 'Access token is no longer vaild', status: 403 - } - ); + }); + } + if (!req.user) { + const User = loopback.getModelByType('User'); + return User.findById(userId) + .then(user => { + if (user) { + user.points = user.progressTimestamps.length; + req.user = user; + } + return; + }) + .then(next) + .catch(next); + } else { + return next(); + } } - if (!req.user) { - const User = loopback.getModelByType('User'); - return User.findById(userId) - .then(user => { - if (user) { - user.points = user.progressTimestamps.length; - req.user = user; - } - return; - }) - .then(next) - .catch(next); - } else { - return next(); - } - } - return next(); -}; + return next(); + }; diff --git a/client/src/utils/ajax.js b/client/src/utils/ajax.js index 84a69a9ed1..6a753ecb51 100644 --- a/client/src/utils/ajax.js +++ b/client/src/utils/ajax.js @@ -1,6 +1,6 @@ import axios from 'axios'; -const base = `/internal`; +const base = '/internal'; function get(path) { return axios.get(`${base}${path}`); @@ -46,7 +46,6 @@ export function getArticleById(shortId) { /** POST **/ - export function postReportUser(body) { return post('/user/report-user', body); }