cartodb4/Windshaft-cartodb
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Return an array of middlewares instead of big one in prepare context

Browse Source
This commit is contained in:
Daniel García Aubert
2017-09-22 18:24:16 +02:00
parent 85d4c81e58
commit f7b9287c93
1 changed files with 94 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

184
lib/cartodb/middleware/prepare-context.js
View File

@@ -2,7 +2,6 @@ var assert = require('assert');
var _ = require('underscore');
var step = require('step');
// Whitelist query parameters and attach format
var REQUEST_QUERY_PARAMS_WHITELIST = [
'config',
@@ -25,100 +24,105 @@ var REQUEST_QUERY_PARAMS_WHITELIST = [
* @param callback
*/
module.exports = function prepareContextMiddleware (authApi, pgConnection) {
return function prepareContext (req, res, next) {
var allowedQueryParams = REQUEST_QUERY_PARAMS_WHITELIST;
return [
function cleanUpQueryParams (req, res, next) {
var allowedQueryParams = REQUEST_QUERY_PARAMS_WHITELIST;
if (Array.isArray(req.context.allowedQueryParams)) {
allowedQueryParams = allowedQueryParams.concat(req.context.allowedQueryParams);
}
req.query = _.pick(req.query, allowedQueryParams);
var user = req.context.user;
if ( req.params.token ) {
// Token might match the following patterns:
// - {user}@{tpl_id}@{token}:{cache_buster}
var tksplit = req.params.token.split(':');
req.params.token = tksplit[0];
if ( tksplit.length > 1 ) {
req.params.cache_buster= tksplit[1];
if (Array.isArray(req.context.allowedQueryParams)) {
allowedQueryParams = allowedQueryParams.concat(req.context.allowedQueryParams);
}
tksplit = req.params.token.split('@');
if ( tksplit.length > 1 ) {
req.params.signer = tksplit.shift();
if ( ! req.params.signer ) {
req.params.signer = user;
}
else if ( req.params.signer !== user ) {
var err = new Error(
'Cannot use map signature of user "' + req.params.signer + '" on db of user "' + user + '"'
);
err.http_status = 403;
req.profiler.done('req2params');
next(err);
return;
}
req.query = _.pick(req.query, allowedQueryParams);
next();
},
function prepareContext (req, res, next) {
var user = req.context.user;
if ( req.params.token ) {
// Token might match the following patterns:
// - {user}@{tpl_id}@{token}:{cache_buster}
var tksplit = req.params.token.split(':');
req.params.token = tksplit[0];
if ( tksplit.length > 1 ) {
/*var template_hash = */tksplit.shift(); // unused
req.params.cache_buster= tksplit[1];
}
req.params.token = tksplit.shift();
}
}
// bring all query values onto req.params object
_.extend(req.params, req.query);
// FIXME: Temporary hack to share data between middlewares. Express overrides req.params to
// parse url params to an object and it's performed after matching path and controller.
req.locals = {};
_.extend(req.locals, req.params);
req.profiler.done('req2params.setup');
step(
function getPrivacy(){
authApi.authorize(req, this);
},
function validateAuthorization(err, authorized) {
req.profiler.done('authorize');
assert.ifError(err);
if(!authorized) {
err = new Error("Sorry, you are unauthorized (permission denied)");
err.http_status = 403;
throw err;
}
return null;
},
function getDatabase(err){
assert.ifError(err);
pgConnection.setDBConn(user, req.params, this);
},
function finishSetup(err) {
if ( err ) {
if (err.message && -1 !== err.message.indexOf('name not found')) {
err.http_status = 404;
tksplit = req.params.token.split('@');
if ( tksplit.length > 1 ) {
req.params.signer = tksplit.shift();
if ( ! req.params.signer ) {
req.params.signer = user;
}
req.profiler.done('req2params');
return next(err, req);
else if ( req.params.signer !== user ) {
var err = new Error(
'Cannot use map signature of user "' + req.params.signer + '" on db of user "' + user + '"'
);
err.http_status = 403;
req.profiler.done('req2params');
next(err);
return;
}
if ( tksplit.length > 1 ) {
/*var template_hash = */tksplit.shift(); // unused
}
req.params.token = tksplit.shift();
}
// Add default database connection parameters
// if none given
_.defaults(req.params, {
dbuser: global.environment.postgres.user,
dbpassword: global.environment.postgres.password,
dbhost: global.environment.postgres.host,
dbport: global.environment.postgres.port
});
// FIXME: Temporary hack to share data between middlewares. Express overrides req.params to
// parse url params to an object and it's performed after matching path and controller.
_.defaults(req.locals, req.params);
req.profiler.done('req2params');
next(null, req);
}
);
};
// bring all query values onto req.params object
_.extend(req.params, req.query);
// FIXME: Temporary hack to share data between middlewares. Express overrides req.params to
// parse url params to an object and it's performed after matching path and controller.
req.locals = {};
_.extend(req.locals, req.params);
req.profiler.done('req2params.setup');
step(
function getPrivacy(){
authApi.authorize(req, this);
},
function validateAuthorization(err, authorized) {
req.profiler.done('authorize');
assert.ifError(err);
if(!authorized) {
err = new Error("Sorry, you are unauthorized (permission denied)");
err.http_status = 403;
throw err;
}
return null;
},
function getDatabase(err){
assert.ifError(err);
pgConnection.setDBConn(user, req.params, this);
},
function finishSetup(err) {
if ( err ) {
if (err.message && -1 !== err.message.indexOf('name not found')) {
err.http_status = 404;
}
req.profiler.done('req2params');
return next(err, req);
}
// Add default database connection parameters
// if none given
_.defaults(req.params, {
dbuser: global.environment.postgres.user,
dbpassword: global.environment.postgres.password,
dbhost: global.environment.postgres.host,
dbport: global.environment.postgres.port
});
// FIXME: Temporary hack to share data between middlewares. Express overrides req.params to
// parse url params to an object and it's performed after matching path and controller.
_.defaults(req.locals, req.params);
req.profiler.done('req2params');
next(null, req);
}
);
}
];
};