Merge branch 'separate-app-and-controllers-creation' into separate-routers

2018-04-10 15:59:05 +02:00
parent 61fc15cec0 aa3fb4807b
commit bc45b50290
16 changed files with 1110 additions and 54 deletions
@@ -79,7 +79,7 @@ function authorizedByAPIKey ({ authApi, action, label }) {
    return function authorizedByAPIKeyMiddleware (req, res, next) {
        const { user } = res.locals;

-        authApi.authorizedByAPIKey(user, res, (err, authenticated) => {
+        authApi.authorizedByAPIKey(user, res, (err, authenticated, apikey) => {
            if (err) {
                return next(err);
            }
@@ -91,6 +91,15 @@ function authorizedByAPIKey ({ authApi, action, label }) {
                return next(error);
            }

+            if (apikey.type !== 'master') {
+                const error = new Error('Forbidden');
+                error.type = 'auth';
+                error.subtype = 'api-key-does-not-grant-access';
+                error.http_status = 403;
+
+                return next(error);
+            }
+
            next();
        });
    };