get and check api key credentials from api key: username and token

2018-02-15 17:49:47 +01:00
parent 11aa4d12bd
commit cda2616a8a
8 changed files with 127 additions and 81 deletions
@@ -60,6 +60,7 @@ function isValidApiKey(apikey) {
 //
 AuthApi.prototype.authorizedByAPIKey = function(user, res, callback) {
    const apikeyToken = res.locals.api_key;
+    const apikeyUsername = res.locals.apikeyUsername;

    if ( ! apikeyToken ) {
        return callback(null, false); // no api key, no authorization...
@@ -78,6 +79,15 @@ AuthApi.prototype.authorizedByAPIKey = function(user, res, callback) {
            return callback(error);
        }

+        if (apikeyUsername && (apikeyUsername !== res.locals.user)) {
+            const error = new Error('Forbidden');
+            error.type = 'auth';
+            error.subtype = 'api-key-username-mismatch';
+            error.http_status = 403;
+
+            return callback(error);            
+        }
+
        if (!apikey.grantsMaps) {
            const error = new Error('Forbidden');
            error.type = 'auth';