module:api/access
- Description:
Default security implementation using module:acl, module:signature, module:session, module:users modules, no external dependencies.
The Express middleware parses cookies with session signature, verifies it against the bk_user table, checks ACL if access to requested endpoint is allowed, stores current user in the req.user property.
- Source:
Methods
(static) allow(req, callback)
- Description:
Perform URL based access checks, this is called before the signature verification, very early in the request processing step.
Checks access permissions, calls the callback with the following argument:
- null or undefined to proceed with authentication
- an object with status: 200 to skip authentication and proceed with other routes
- an object with status other than 0 or 200 to return the status and stop request processing, for statuses 301,302 there should be url property in the object returned
- Source:
Parameters:
| Name | Type | Description |
|---|---|---|
req |
Request | |
callback |
function |
(static) authenticate(req, callback)
- Description:
Verify request signature from the request object, uses properties: .host, .method, .url or .originalUrl, .headers
- Source:
Parameters:
| Name | Type | Description |
|---|---|---|
req |
Request | |
callback |
function |
(static) authorize(req, callback)
- Description:
Perform authorization checks after the user been checked for valid signature.
At least one acl must match to proceed.
- Source:
Parameters:
| Name | Type | Description |
|---|---|---|
req |
Request | is Express request object |
callback |
function | is a function(status) to be called with the final status |
(static) configureMiddleware()
- Description:
Install authentication/authorization middleware
- Source:
(static) middleware(req, res, callback)
- Description:
Implements full authentication and authorizarion of each request Steps:
- check if access is allowed by path via "access" hooks, calls module:api/access.allow
- if status given and not 200 return the error
- if not matched continue othwewise check CSRF
- run module:api/access.authenticate, if status is not 200 return an error
- check CSRF token module:api/csrf.check
- run module:api/access.authorize, at least one ACL must match, on error return
- check for routing module:api/routing.check
- Source:
Parameters:
| Name | Type | Description |
|---|---|---|
req |
Request | |
res |
Response | |
callback |
function |
(static) setUser(req, user)
- Description:
Assign or clear the current user record for the given request, if user is null the current is cleared.
- Source:
Parameters:
| Name | Type | Description |
|---|---|---|
req |
Request | |
user |
object |