From e9d925334ca774882ebba19650a721a1172671a0 Mon Sep 17 00:00:00 2001
From: Raul Ochoa <rochoaf@gmail.com>
Date: Fri, 4 Aug 2017 17:51:10 +0200
Subject: [PATCH 1/4] Move layergroup-token to models

We will share it between tests and a middleware to parse the token.
---
 {test/support => lib/cartodb/models}/layergroup-token.js | 0
 test/acceptance/analysis/named-maps.js                   | 2 +-
 test/acceptance/cache/cache_headers.js                   | 2 +-
 test/acceptance/dynamic-styling-named-maps.js            | 2 +-
 test/acceptance/limits.js                                | 2 +-
 test/acceptance/multilayer.js                            | 2 +-
 test/acceptance/multilayer_server.js                     | 2 +-
 test/acceptance/named_layers.js                          | 2 +-
 test/acceptance/overviews_metadata.js                    | 2 +-
 test/acceptance/overviews_metadata_named_maps.js         | 2 +-
 test/acceptance/ported/attributes.js                     | 2 +-
 test/acceptance/ported/multilayer.js                     | 2 +-
 test/acceptance/ported/multilayer_interactivity.js       | 2 +-
 test/acceptance/ported/raster.js                         | 2 +-
 test/acceptance/ported/retina.js                         | 2 +-
 test/acceptance/ported/server_png8_format.js             | 2 +-
 test/acceptance/ported/support/ported_server_options.js  | 2 +-
 test/acceptance/ported/support/test_client.js            | 2 +-
 test/acceptance/ported/torque.js                         | 2 +-
 test/acceptance/ported/torque_boundaries.js              | 2 +-
 test/acceptance/templates.js                             | 2 +-
 test/acceptance/turbo-carto/named-maps.js                | 2 +-
 test/acceptance/widgets/named-maps.js                    | 2 +-
 test/support/test-client.js                              | 2 +-
 24 files changed, 23 insertions(+), 23 deletions(-)
 rename {test/support => lib/cartodb/models}/layergroup-token.js (100%)

diff --git a/test/support/layergroup-token.js b/lib/cartodb/models/layergroup-token.js
similarity index 100%
rename from test/support/layergroup-token.js
rename to lib/cartodb/models/layergroup-token.js
diff --git a/test/acceptance/analysis/named-maps.js b/test/acceptance/analysis/named-maps.js
index ca27ec37..b9c93e00 100644
--- a/test/acceptance/analysis/named-maps.js
+++ b/test/acceptance/analysis/named-maps.js
@@ -7,7 +7,7 @@ var serverOptions = require('../../../lib/cartodb/server_options');
 var server = new CartodbWindshaft(serverOptions);
 var TestClient = require('../../support/test-client');
 
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 describe('named-maps analysis', function() {
 
diff --git a/test/acceptance/cache/cache_headers.js b/test/acceptance/cache/cache_headers.js
index 2cd916af..e7d8caf3 100644
--- a/test/acceptance/cache/cache_headers.js
+++ b/test/acceptance/cache/cache_headers.js
@@ -8,7 +8,7 @@ var serverOptions = require('../../../lib/cartodb/server_options');
 var server = new CartodbWindshaft(serverOptions);
 server.setMaxListeners(0);
 
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 describe('get requests with cache headers', function() {
 
diff --git a/test/acceptance/dynamic-styling-named-maps.js b/test/acceptance/dynamic-styling-named-maps.js
index 5fe2db3c..87796c5e 100644
--- a/test/acceptance/dynamic-styling-named-maps.js
+++ b/test/acceptance/dynamic-styling-named-maps.js
@@ -1,6 +1,6 @@
 var assert = require('../support/assert');
 var step = require('step');
-var LayergroupToken = require('../support/layergroup-token');
+var LayergroupToken = require('../../lib/cartodb/models/layergroup-token');
 var testHelper = require(__dirname + '/../support/test_helper');
 var CartodbWindshaft = require(__dirname + '/../../lib/cartodb/server');
 var serverOptions = require(__dirname + '/../../lib/cartodb/server_options');
diff --git a/test/acceptance/limits.js b/test/acceptance/limits.js
index d0126623..ffe633ec 100644
--- a/test/acceptance/limits.js
+++ b/test/acceptance/limits.js
@@ -7,7 +7,7 @@ var redis = require('redis');
 var CartodbWindshaft = require('../../lib/cartodb/server');
 var serverOptions = require('../../lib/cartodb/server_options');
 
-var LayergroupToken = require('../support/layergroup-token');
+var LayergroupToken = require('../../lib/cartodb/models/layergroup-token');
 
 describe('render limits', function() {
 
diff --git a/test/acceptance/multilayer.js b/test/acceptance/multilayer.js
index 210418ac..9d287a58 100644
--- a/test/acceptance/multilayer.js
+++ b/test/acceptance/multilayer.js
@@ -9,7 +9,7 @@ var mapnik = require('windshaft').mapnik;
 var semver = require('semver');
 
 var helper = require(__dirname + '/../support/test_helper');
-var LayergroupToken = require('../support/layergroup-token');
+var LayergroupToken = require('../../lib/cartodb/models/layergroup-token');
 
 var windshaft_fixtures = __dirname + '/../../node_modules/windshaft/test/fixtures';
 
diff --git a/test/acceptance/multilayer_server.js b/test/acceptance/multilayer_server.js
index ba44e2d1..b599cf9c 100644
--- a/test/acceptance/multilayer_server.js
+++ b/test/acceptance/multilayer_server.js
@@ -4,7 +4,7 @@ var assert = require('../support/assert');
 
 var _ = require('underscore');
 
-var LayergroupToken = require('../support/layergroup-token');
+var LayergroupToken = require('../../lib/cartodb/models/layergroup-token');
 
 var PgQueryRunner = require('../../lib/cartodb/backends/pg_query_runner');
 var QueryTables = require('cartodb-query-tables');
diff --git a/test/acceptance/named_layers.js b/test/acceptance/named_layers.js
index 2b1cf4ef..9c0a9966 100644
--- a/test/acceptance/named_layers.js
+++ b/test/acceptance/named_layers.js
@@ -5,7 +5,7 @@ var CartodbWindshaft = require(__dirname + '/../../lib/cartodb/server');
 var serverOptions = require(__dirname + '/../../lib/cartodb/server_options');
 var server = new CartodbWindshaft(serverOptions);
 
-var LayergroupToken = require('../support/layergroup-token');
+var LayergroupToken = require('../../lib/cartodb/models/layergroup-token');
 
 var RedisPool = require('redis-mpool');
 var TemplateMaps = require('../../lib/cartodb/backends/template_maps.js');
diff --git a/test/acceptance/overviews_metadata.js b/test/acceptance/overviews_metadata.js
index ad0f23e5..8af7b2a4 100644
--- a/test/acceptance/overviews_metadata.js
+++ b/test/acceptance/overviews_metadata.js
@@ -5,7 +5,7 @@ var CartodbWindshaft = require(__dirname + '/../../lib/cartodb/server');
 var serverOptions = require(__dirname + '/../../lib/cartodb/server_options');
 var server = new CartodbWindshaft(serverOptions);
 
-var LayergroupToken = require('../support/layergroup-token');
+var LayergroupToken = require('../../lib/cartodb/models/layergroup-token');
 
 var RedisPool = require('redis-mpool');
 
diff --git a/test/acceptance/overviews_metadata_named_maps.js b/test/acceptance/overviews_metadata_named_maps.js
index 8e9720ec..a6557910 100644
--- a/test/acceptance/overviews_metadata_named_maps.js
+++ b/test/acceptance/overviews_metadata_named_maps.js
@@ -5,7 +5,7 @@ var CartodbWindshaft = require(__dirname + '/../../lib/cartodb/server');
 var serverOptions = require(__dirname + '/../../lib/cartodb/server_options');
 var server = new CartodbWindshaft(serverOptions);
 
-var LayergroupToken = require('../support/layergroup-token');
+var LayergroupToken = require('../../lib/cartodb/models/layergroup-token');
 
 var RedisPool = require('redis-mpool');
 
diff --git a/test/acceptance/ported/attributes.js b/test/acceptance/ported/attributes.js
index 04b48826..39f3f461 100644
--- a/test/acceptance/ported/attributes.js
+++ b/test/acceptance/ported/attributes.js
@@ -6,7 +6,7 @@ var cartodbServer = require('../../../lib/cartodb/server');
 var PortedServerOptions = require('./support/ported_server_options');
 var BaseController = require('../../../lib/cartodb/controllers/base');
 
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 
 describe('attributes', function() {
diff --git a/test/acceptance/ported/multilayer.js b/test/acceptance/ported/multilayer.js
index fa6648f4..0592c147 100644
--- a/test/acceptance/ported/multilayer.js
+++ b/test/acceptance/ported/multilayer.js
@@ -7,7 +7,7 @@ var step = require('step');
 var mapnik = require('windshaft').mapnik;
 var cartodbServer = require('../../../lib/cartodb/server');
 var ServerOptions = require('./support/ported_server_options');
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 var BaseController = require('../../../lib/cartodb/controllers/base');
 
 describe('multilayer', function() {
diff --git a/test/acceptance/ported/multilayer_interactivity.js b/test/acceptance/ported/multilayer_interactivity.js
index 3f3f12b1..7d512670 100644
--- a/test/acceptance/ported/multilayer_interactivity.js
+++ b/test/acceptance/ported/multilayer_interactivity.js
@@ -5,7 +5,7 @@ var _             = require('underscore');
 var cartodbServer = require('../../../lib/cartodb/server');
 var getLayerTypeFn = require('windshaft').model.MapConfig.prototype.getType;
 var PortedServerOptions = require('./support/ported_server_options');
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 var BaseController = require('../../../lib/cartodb/controllers/base');
 
diff --git a/test/acceptance/ported/raster.js b/test/acceptance/ported/raster.js
index fc26661b..b16dd56d 100644
--- a/test/acceptance/ported/raster.js
+++ b/test/acceptance/ported/raster.js
@@ -6,7 +6,7 @@ var cartodbServer = require('../../../lib/cartodb/server');
 var ServerOptions = require('./support/ported_server_options');
 
 var BaseController = require('../../../lib/cartodb/controllers/base');
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 describe('raster', function() {
 
diff --git a/test/acceptance/ported/retina.js b/test/acceptance/ported/retina.js
index 0962619f..80c3fcc5 100644
--- a/test/acceptance/ported/retina.js
+++ b/test/acceptance/ported/retina.js
@@ -6,7 +6,7 @@ var cartodbServer = require('../../../lib/cartodb/server');
 var ServerOptions = require('./support/ported_server_options');
 
 var BaseController = require('../../../lib/cartodb/controllers/base');
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 describe('retina support', function() {
 
diff --git a/test/acceptance/ported/server_png8_format.js b/test/acceptance/ported/server_png8_format.js
index a710cbd0..092e9ad7 100644
--- a/test/acceptance/ported/server_png8_format.js
+++ b/test/acceptance/ported/server_png8_format.js
@@ -7,7 +7,7 @@ var cartodbServer = require('../../../lib/cartodb/server');
 var ServerOptions = require('./support/ported_server_options');
 
 var BaseController = require('../../../lib/cartodb/controllers/base');
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 var IMAGE_EQUALS_TOLERANCE_PER_MIL = 85;
 
diff --git a/test/acceptance/ported/support/ported_server_options.js b/test/acceptance/ported/support/ported_server_options.js
index 875d42dc..d9af2d91 100644
--- a/test/acceptance/ported/support/ported_server_options.js
+++ b/test/acceptance/ported/support/ported_server_options.js
@@ -1,6 +1,6 @@
 var _ = require('underscore');
 var serverOptions = require('../../../../lib/cartodb/server_options');
-var LayergroupToken = require('../../../support/layergroup-token');
+var LayergroupToken = require('../../../../lib/cartodb/models/layergroup-token');
 var mapnik = require('windshaft').mapnik;
 var OverviewsQueryRewriter = require('../../../../lib/cartodb/utils/overviews_query_rewriter');
 var overviewsQueryRewriter = new OverviewsQueryRewriter({
diff --git a/test/acceptance/ported/support/test_client.js b/test/acceptance/ported/support/test_client.js
index dad3ff3e..640f1b64 100644
--- a/test/acceptance/ported/support/test_client.js
+++ b/test/acceptance/ported/support/test_client.js
@@ -1,5 +1,5 @@
 var testHelper = require('../../../support/test_helper');
-var LayergroupToken = require('../../../support/layergroup-token');
+var LayergroupToken = require('../../../../lib/cartodb/models/layergroup-token');
 
 var step = require('step');
 var assert = require('../../../support/assert');
diff --git a/test/acceptance/ported/torque.js b/test/acceptance/ported/torque.js
index ac4422cc..c148a521 100644
--- a/test/acceptance/ported/torque.js
+++ b/test/acceptance/ported/torque.js
@@ -7,7 +7,7 @@ var cartodbServer = require('../../../lib/cartodb/server');
 var ServerOptions = require('./support/ported_server_options');
 
 var BaseController = require('../../../lib/cartodb/controllers/base');
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 describe('torque', function() {
 
diff --git a/test/acceptance/ported/torque_boundaries.js b/test/acceptance/ported/torque_boundaries.js
index fb88be52..1456c055 100644
--- a/test/acceptance/ported/torque_boundaries.js
+++ b/test/acceptance/ported/torque_boundaries.js
@@ -5,7 +5,7 @@ var cartodbServer = require('../../../lib/cartodb/server');
 var ServerOptions = require('./support/ported_server_options');
 
 var BaseController = require('../../../lib/cartodb/controllers/base');
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 describe('torque boundary points', function() {
 
diff --git a/test/acceptance/templates.js b/test/acceptance/templates.js
index 74d34d82..92a95f60 100644
--- a/test/acceptance/templates.js
+++ b/test/acceptance/templates.js
@@ -23,7 +23,7 @@ var serverOptions = require(__dirname + '/../../lib/cartodb/server_options');
 var server = new CartodbWindshaft(serverOptions);
 server.setMaxListeners(0);
 
-var LayergroupToken = require('../support/layergroup-token');
+var LayergroupToken = require('../../lib/cartodb/models/layergroup-token');
 
 describe('template_api', function() {
     server.layergroupAffectedTablesCache.cache.reset();
diff --git a/test/acceptance/turbo-carto/named-maps.js b/test/acceptance/turbo-carto/named-maps.js
index 4597ea3c..063118aa 100644
--- a/test/acceptance/turbo-carto/named-maps.js
+++ b/test/acceptance/turbo-carto/named-maps.js
@@ -1,6 +1,6 @@
 var assert = require('../../support/assert');
 var step = require('step');
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 var testHelper = require('../../support/test_helper');
 var CartodbWindshaft = require('../../../lib/cartodb/server');
 var serverOptions = require('../../../lib/cartodb/server_options');
diff --git a/test/acceptance/widgets/named-maps.js b/test/acceptance/widgets/named-maps.js
index eb5a0d29..e54ced23 100644
--- a/test/acceptance/widgets/named-maps.js
+++ b/test/acceptance/widgets/named-maps.js
@@ -10,7 +10,7 @@ var CartodbWindshaft = require('../../../lib/cartodb/server');
 var serverOptions = require('../../../lib/cartodb/server_options');
 var server = new CartodbWindshaft(serverOptions);
 
-var LayergroupToken = require('../../support/layergroup-token');
+var LayergroupToken = require('../../../lib/cartodb/models/layergroup-token');
 
 describe('named-maps widgets', function() {
 
diff --git a/test/support/test-client.js b/test/support/test-client.js
index bc00bc15..e1ed744c 100644
--- a/test/support/test-client.js
+++ b/test/support/test-client.js
@@ -6,7 +6,7 @@ var urlParser = require('url');
 
 var mapnik = require('windshaft').mapnik;
 
-var LayergroupToken = require('./layergroup-token');
+var LayergroupToken = require('../../lib/cartodb/models/layergroup-token');
 
 var assert = require('./assert');
 var helper = require('./test_helper');

From 22b7828725751c51655b0a2d4c43d5e825ddf5e2 Mon Sep 17 00:00:00 2001
From: Raul Ochoa <rochoaf@gmail.com>
Date: Fri, 22 Sep 2017 12:05:40 +0000
Subject: [PATCH 2/4] Layergroup Token parsing as middleware

Reuses LayergroupToken model from tests.
---
 lib/cartodb/controllers/layergroup.js         | 16 ++++++---
 lib/cartodb/middleware/layergroup-token.js    | 35 +++++++++++++++++++
 .../ported/support/ported_server_options.js   |  9 +++--
 3 files changed, 53 insertions(+), 7 deletions(-)
 create mode 100644 lib/cartodb/middleware/layergroup-token.js

diff --git a/lib/cartodb/controllers/layergroup.js b/lib/cartodb/controllers/layergroup.js
index 9644aa06..f787c426 100644
--- a/lib/cartodb/controllers/layergroup.js
+++ b/lib/cartodb/controllers/layergroup.js
@@ -6,6 +6,7 @@ var BaseController = require('./base');
 
 var cors = require('../middleware/cors');
 var userMiddleware = require('../middleware/user');
+var layergroupTokenMiddleware = require('../middleware/layergroup-token');
 var allowQueryParams = require('../middleware/allow-query-params');
 
 var DataviewBackend = require('../backends/dataview');
@@ -52,29 +53,31 @@ module.exports = LayergroupController;
 
 LayergroupController.prototype.register = function(app) {
     app.get(app.base_url_mapconfig +
-        '/:token/:z/:x/:y@:scale_factor?x.:format', cors(), userMiddleware,
+        '/:token/:z/:x/:y@:scale_factor?x.:format', cors(), userMiddleware, layergroupTokenMiddleware,
         this.tile.bind(this));
 
     app.get(app.base_url_mapconfig +
-        '/:token/:z/:x/:y.:format', cors(), userMiddleware,
+        '/:token/:z/:x/:y.:format', cors(), userMiddleware, layergroupTokenMiddleware,
         this.tile.bind(this));
 
     app.get(app.base_url_mapconfig +
-        '/:token/:layer/:z/:x/:y.(:format)', cors(), userMiddleware,
+        '/:token/:layer/:z/:x/:y.(:format)', cors(), userMiddleware, layergroupTokenMiddleware,
         this.layer.bind(this));
 
     app.get(app.base_url_mapconfig +
-        '/:token/:layer/attributes/:fid', cors(), userMiddleware,
+        '/:token/:layer/attributes/:fid', cors(), userMiddleware, layergroupTokenMiddleware,
         this.attributes.bind(this));
 
     app.get(app.base_url_mapconfig +
         '/static/center/:token/:z/:lat/:lng/:width/:height.:format',
         cors(), userMiddleware, allowQueryParams(['layer']),
+        layergroupTokenMiddleware,
         this.center.bind(this));
 
     app.get(app.base_url_mapconfig +
         '/static/bbox/:token/:west,:south,:east,:north/:width/:height.:format',
         cors(), userMiddleware, allowQueryParams(['layer']),
+        layergroupTokenMiddleware,
         this.bbox.bind(this));
 
     // Undocumented/non-supported API endpoint methods.
@@ -98,6 +101,7 @@ LayergroupController.prototype.register = function(app) {
         cors(),
         userMiddleware,
         allowQueryParams(allowedDataviewQueryParams),
+        layergroupTokenMiddleware,
         this.dataview.bind(this)
     );
 
@@ -106,6 +110,7 @@ LayergroupController.prototype.register = function(app) {
         cors(),
         userMiddleware,
         allowQueryParams(allowedDataviewQueryParams),
+        layergroupTokenMiddleware,
         this.dataview.bind(this)
     );
 
@@ -114,6 +119,7 @@ LayergroupController.prototype.register = function(app) {
         cors(),
         userMiddleware,
         allowQueryParams(allowedDataviewQueryParams),
+        layergroupTokenMiddleware,
         this.dataviewSearch.bind(this)
     );
 
@@ -122,11 +128,13 @@ LayergroupController.prototype.register = function(app) {
         cors(),
         userMiddleware,
         allowQueryParams(allowedDataviewQueryParams),
+        layergroupTokenMiddleware,
         this.dataviewSearch.bind(this)
     );
 
     app.get(app.base_url_mapconfig +
         '/:token/analysis/node/:nodeId', cors(), userMiddleware,
+        layergroupTokenMiddleware,
         this.analysisNodeStatus.bind(this));
 };
 
diff --git a/lib/cartodb/middleware/layergroup-token.js b/lib/cartodb/middleware/layergroup-token.js
new file mode 100644
index 00000000..d9f7d214
--- /dev/null
+++ b/lib/cartodb/middleware/layergroup-token.js
@@ -0,0 +1,35 @@
+var LayergroupToken = require('../models/layergroup-token');
+
+module.exports = function layergroupTokenMiddleware(req, res, next) {
+    if (!req.params.hasOwnProperty('token')) {
+        return next();
+    }
+
+    var user = req.context.user;
+
+    var layergroupToken = LayergroupToken.parse(req.params.token);
+    req.params.token = layergroupToken.token;
+    req.params.cache_buster = layergroupToken.cacheBuster;
+
+    if (layergroupToken.signer) {
+        req.params.signer = layergroupToken.signer;
+        if (!req.params.signer) {
+            req.params.signer = user;
+        } else if (req.params.signer !== user) {
+            var statusCode = 403;
+            if (req.query && req.query.callback) {
+                statusCode = 200;
+            }
+            var errorMessage = `Cannot use map signature of user "${req.params.signer}" on db of user "{${user}"`;
+            return res.status(statusCode).json({
+                errors: [errorMessage],
+                errors_with_context: [{
+                    type: 'auth',
+                    message: errorMessage
+                }]
+            });
+        }
+    }
+
+    return next();
+};
diff --git a/test/acceptance/ported/support/ported_server_options.js b/test/acceptance/ported/support/ported_server_options.js
index d9af2d91..9943658d 100644
--- a/test/acceptance/ported/support/ported_server_options.js
+++ b/test/acceptance/ported/support/ported_server_options.js
@@ -56,9 +56,12 @@ module.exports = _.extend({}, serverOptions, {
 
         // this is in case you want to test sql parameters eg ...png?sql=select * from my_table limit 10
         req.params =  _.extend({}, req.params);
-        if (req.params.token) {
-            req.params.token = LayergroupToken.parse(req.params.token).token;
-        }
+
+        // We don't want to inherit Date.now() `cache_buster` as it is the default value
+        // introduced by the middleware when no cache buster is found.
+        // We are only interested in the `token` for the ported tests.
+        delete req.params.cache_buster;
+        delete req.params.signer;
 
         _.extend(req.params, req.query);
         req.params.user = 'localhost';

From 2eb1c0f3e0bb916e8f205f7930ba00044eb12064 Mon Sep 17 00:00:00 2001
From: Raul Ochoa <rochoaf@gmail.com>
Date: Fri, 22 Sep 2017 12:59:14 +0000
Subject: [PATCH 3/4] Remove unused import

---
 test/acceptance/ported/support/ported_server_options.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/test/acceptance/ported/support/ported_server_options.js b/test/acceptance/ported/support/ported_server_options.js
index 9943658d..a2302288 100644
--- a/test/acceptance/ported/support/ported_server_options.js
+++ b/test/acceptance/ported/support/ported_server_options.js
@@ -1,6 +1,5 @@
 var _ = require('underscore');
 var serverOptions = require('../../../../lib/cartodb/server_options');
-var LayergroupToken = require('../../../../lib/cartodb/models/layergroup-token');
 var mapnik = require('windshaft').mapnik;
 var OverviewsQueryRewriter = require('../../../../lib/cartodb/utils/overviews_query_rewriter');
 var overviewsQueryRewriter = new OverviewsQueryRewriter({

From 178b9e85634f936649c65b3ec4df40b9f4fc4e06 Mon Sep 17 00:00:00 2001
From: Simon <oleurud@gmail.com>
Date: Wed, 27 Sep 2017 16:32:49 +0200
Subject: [PATCH 4/4] moving layergroup-token middleware to middlewarify style

---
 lib/cartodb/middleware/context/index.js       |  4 ++--
 .../{ => context}/layergroup-token.js         | 19 ++++++++-----------
 .../ported/support/ported_server_options.js   |  9 ++++-----
 3 files changed, 14 insertions(+), 18 deletions(-)
 rename lib/cartodb/middleware/{ => context}/layergroup-token.js (57%)

diff --git a/lib/cartodb/middleware/context/index.js b/lib/cartodb/middleware/context/index.js
index 9d87b6ee..411b6f93 100644
--- a/lib/cartodb/middleware/context/index.js
+++ b/lib/cartodb/middleware/context/index.js
@@ -1,12 +1,12 @@
 const cleanUpQueryParams = require('./clean-up-query-params');
-const parseTokenParam = require('./parse-token-param');
+const layergroupToken = require('./layergroup-token');
 const authorize = require('./authorize');
 const dbConnSetup = require('./db-conn-setup');
 
 module.exports = function prepareContextMiddleware(authApi, pgConnection) {
     return [
         cleanUpQueryParams(),
-        parseTokenParam(),
+        layergroupToken,
         authorize(authApi),
         dbConnSetup(pgConnection)
     ];
diff --git a/lib/cartodb/middleware/layergroup-token.js b/lib/cartodb/middleware/context/layergroup-token.js
similarity index 57%
rename from lib/cartodb/middleware/layergroup-token.js
rename to lib/cartodb/middleware/context/layergroup-token.js
index d9f7d214..d1ccb3be 100644
--- a/lib/cartodb/middleware/layergroup-token.js
+++ b/lib/cartodb/middleware/context/layergroup-token.js
@@ -1,4 +1,4 @@
-var LayergroupToken = require('../models/layergroup-token');
+var LayergroupToken = require('../../models/layergroup-token');
 
 module.exports = function layergroupTokenMiddleware(req, res, next) {
     if (!req.params.hasOwnProperty('token')) {
@@ -16,18 +16,15 @@ module.exports = function layergroupTokenMiddleware(req, res, next) {
         if (!req.params.signer) {
             req.params.signer = user;
         } else if (req.params.signer !== user) {
-            var statusCode = 403;
+            var err = new Error(`Cannot use map signature of user "${req.params.signer}" on db of user "${user}"`);
+            err.type = 'auth';
+            err.http_status = 403;
             if (req.query && req.query.callback) {
-                statusCode = 200;
+                err.http_status = 200;
             }
-            var errorMessage = `Cannot use map signature of user "${req.params.signer}" on db of user "{${user}"`;
-            return res.status(statusCode).json({
-                errors: [errorMessage],
-                errors_with_context: [{
-                    type: 'auth',
-                    message: errorMessage
-                }]
-            });
+            
+            req.profiler.done('req2params');
+            return next(err);
         }
     }
 
diff --git a/test/acceptance/ported/support/ported_server_options.js b/test/acceptance/ported/support/ported_server_options.js
index af299664..36684f77 100644
--- a/test/acceptance/ported/support/ported_server_options.js
+++ b/test/acceptance/ported/support/ported_server_options.js
@@ -1,6 +1,7 @@
 var _ = require('underscore');
 var serverOptions = require('../../../../lib/cartodb/server_options');
 var mapnik = require('windshaft').mapnik;
+var LayergroupToken = require('../../../../lib/cartodb/models/layergroup-token');
 var OverviewsQueryRewriter = require('../../../../lib/cartodb/utils/overviews_query_rewriter');
 var overviewsQueryRewriter = new OverviewsQueryRewriter({
   zoom_level: 'CDB_ZoomFromScale(!scale_denominator!)'
@@ -56,11 +57,9 @@ module.exports = _.extend({}, serverOptions, {
         // this is in case you want to test sql parameters eg ...png?sql=select * from my_table limit 10
         req.params =  _.extend({}, req.params);
 
-        // We don't want to inherit Date.now() `cache_buster` as it is the default value
-        // introduced by the middleware when no cache buster is found.
-        // We are only interested in the `token` for the ported tests.
-        delete req.params.cache_buster;
-        delete req.params.signer;
+        if (req.params.token) {
+            req.params.token = LayergroupToken.parse(req.params.token).token;
+        }
 
         _.extend(req.params, req.query);
         req.params.user = 'localhost';