From 84b7d78ea42a7d86bbf0cf42d672487afa3e848e Mon Sep 17 00:00:00 2001
From: Sandro Santilli <strk@keybit.net>
Date: Tue, 17 Dec 2013 11:43:56 +0100
Subject: [PATCH] Add an utility authorizedByAPIKey method for reuse

---
 lib/cartodb/server_options.js | 46 ++++++++++++++++++++++++++---------
 1 file changed, 34 insertions(+), 12 deletions(-)

diff --git a/lib/cartodb/server_options.js b/lib/cartodb/server_options.js
index 8341530d..21a995da 100644
--- a/lib/cartodb/server_options.js
+++ b/lib/cartodb/server_options.js
@@ -373,6 +373,37 @@ module.exports = function(){
       );
     }
 
+    // Check if a request is authorized by api_key
+    //
+    // @param req express request object
+    // @param callback function(err, authorized) 
+    //                 
+    me.authorizedByAPIKey = function(req, callback)
+    {
+        var user = me.userByReq(req);
+        Step(
+          function (){
+              cartoData.getUserMapKey(user, this);
+          },
+          function checkApiKey(err, val){
+              if (err) throw err;
+
+              var valid = 0;
+              if ( val ) {
+                if ( val == req.query.map_key ) valid = 1;
+                else if ( val == req.query.api_key ) valid = 1;
+                // check also in request body
+                else if ( req.body && req.body.map_key && val == req.body.map_key ) valid = 1;
+                else if ( req.body && req.body.api_key && val == req.body.api_key ) valid = 1;
+              }
+              return valid;
+          },
+          function finish(err, authorized) {
+              callback(err, authorized);
+          }
+        );
+    };
+
     /**
      * Check access authorization
      *
@@ -385,22 +416,13 @@ module.exports = function(){
 
         Step(
             function (){
-                cartoData.getUserMapKey(user, this);
+                that.authorizedByAPIKey(req, this);
             },
-            function checkApiKey(err, val){
+            function checkApiKey(err, authorized){
                 if (err) throw err;
 
-                var valid = 0;
-                if ( val ) {
-                  if ( val == req.query.map_key ) valid = 1;
-                  else if ( val == req.query.api_key ) valid = 1;
-                  // check also in request body
-                  else if ( req.body && req.body.map_key && val == req.body.map_key ) valid = 1;
-                  else if ( req.body && req.body.api_key && val == req.body.api_key ) valid = 1;
-                }
-
                 // if not authorized by api_key, continue 
-                if (valid !== 1) return null;
+                if (authorized !== 1) return null;
 
                 // authorized by api key, login as the given username and stop
                 that.setDBAuth(user, req.params, function(err) {