From f7b9287c93a41c4d5715d33c402e408a68ecf5b1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Garc=C3=ADa=20Aubert?= Date: Fri, 22 Sep 2017 18:24:16 +0200 Subject: [PATCH] Return an array of middlewares instead of big one in prepare context --- lib/cartodb/middleware/prepare-context.js | 184 +++++++++++----------- 1 file changed, 94 insertions(+), 90 deletions(-) diff --git a/lib/cartodb/middleware/prepare-context.js b/lib/cartodb/middleware/prepare-context.js index ee8e08cb..f48d4047 100644 --- a/lib/cartodb/middleware/prepare-context.js +++ b/lib/cartodb/middleware/prepare-context.js @@ -2,7 +2,6 @@ var assert = require('assert'); var _ = require('underscore'); var step = require('step'); - // Whitelist query parameters and attach format var REQUEST_QUERY_PARAMS_WHITELIST = [ 'config', @@ -25,100 +24,105 @@ var REQUEST_QUERY_PARAMS_WHITELIST = [ * @param callback */ module.exports = function prepareContextMiddleware (authApi, pgConnection) { - return function prepareContext (req, res, next) { - var allowedQueryParams = REQUEST_QUERY_PARAMS_WHITELIST; + return [ + function cleanUpQueryParams (req, res, next) { + var allowedQueryParams = REQUEST_QUERY_PARAMS_WHITELIST; - if (Array.isArray(req.context.allowedQueryParams)) { - allowedQueryParams = allowedQueryParams.concat(req.context.allowedQueryParams); - } - - req.query = _.pick(req.query, allowedQueryParams); - - var user = req.context.user; - - if ( req.params.token ) { - // Token might match the following patterns: - // - {user}@{tpl_id}@{token}:{cache_buster} - var tksplit = req.params.token.split(':'); - req.params.token = tksplit[0]; - if ( tksplit.length > 1 ) { - req.params.cache_buster= tksplit[1]; + if (Array.isArray(req.context.allowedQueryParams)) { + allowedQueryParams = allowedQueryParams.concat(req.context.allowedQueryParams); } - tksplit = req.params.token.split('@'); - if ( tksplit.length > 1 ) { - req.params.signer = tksplit.shift(); - if ( ! req.params.signer ) { - req.params.signer = user; - } - else if ( req.params.signer !== user ) { - var err = new Error( - 'Cannot use map signature of user "' + req.params.signer + '" on db of user "' + user + '"' - ); - err.http_status = 403; - req.profiler.done('req2params'); - next(err); - return; - } + + req.query = _.pick(req.query, allowedQueryParams); + + next(); + }, + function prepareContext (req, res, next) { + var user = req.context.user; + + if ( req.params.token ) { + // Token might match the following patterns: + // - {user}@{tpl_id}@{token}:{cache_buster} + var tksplit = req.params.token.split(':'); + req.params.token = tksplit[0]; if ( tksplit.length > 1 ) { - /*var template_hash = */tksplit.shift(); // unused + req.params.cache_buster= tksplit[1]; } - req.params.token = tksplit.shift(); - } - } - - // bring all query values onto req.params object - _.extend(req.params, req.query); - - // FIXME: Temporary hack to share data between middlewares. Express overrides req.params to - // parse url params to an object and it's performed after matching path and controller. - req.locals = {}; - _.extend(req.locals, req.params); - - req.profiler.done('req2params.setup'); - - step( - function getPrivacy(){ - authApi.authorize(req, this); - }, - function validateAuthorization(err, authorized) { - req.profiler.done('authorize'); - assert.ifError(err); - if(!authorized) { - err = new Error("Sorry, you are unauthorized (permission denied)"); - err.http_status = 403; - throw err; - } - return null; - }, - function getDatabase(err){ - assert.ifError(err); - pgConnection.setDBConn(user, req.params, this); - }, - function finishSetup(err) { - if ( err ) { - if (err.message && -1 !== err.message.indexOf('name not found')) { - err.http_status = 404; + tksplit = req.params.token.split('@'); + if ( tksplit.length > 1 ) { + req.params.signer = tksplit.shift(); + if ( ! req.params.signer ) { + req.params.signer = user; } - req.profiler.done('req2params'); - return next(err, req); + else if ( req.params.signer !== user ) { + var err = new Error( + 'Cannot use map signature of user "' + req.params.signer + '" on db of user "' + user + '"' + ); + err.http_status = 403; + req.profiler.done('req2params'); + next(err); + return; + } + if ( tksplit.length > 1 ) { + /*var template_hash = */tksplit.shift(); // unused + } + req.params.token = tksplit.shift(); } - - // Add default database connection parameters - // if none given - _.defaults(req.params, { - dbuser: global.environment.postgres.user, - dbpassword: global.environment.postgres.password, - dbhost: global.environment.postgres.host, - dbport: global.environment.postgres.port - }); - - // FIXME: Temporary hack to share data between middlewares. Express overrides req.params to - // parse url params to an object and it's performed after matching path and controller. - _.defaults(req.locals, req.params); - - req.profiler.done('req2params'); - next(null, req); } - ); - }; + + // bring all query values onto req.params object + _.extend(req.params, req.query); + + // FIXME: Temporary hack to share data between middlewares. Express overrides req.params to + // parse url params to an object and it's performed after matching path and controller. + req.locals = {}; + _.extend(req.locals, req.params); + + req.profiler.done('req2params.setup'); + + step( + function getPrivacy(){ + authApi.authorize(req, this); + }, + function validateAuthorization(err, authorized) { + req.profiler.done('authorize'); + assert.ifError(err); + if(!authorized) { + err = new Error("Sorry, you are unauthorized (permission denied)"); + err.http_status = 403; + throw err; + } + return null; + }, + function getDatabase(err){ + assert.ifError(err); + pgConnection.setDBConn(user, req.params, this); + }, + function finishSetup(err) { + if ( err ) { + if (err.message && -1 !== err.message.indexOf('name not found')) { + err.http_status = 404; + } + req.profiler.done('req2params'); + return next(err, req); + } + + // Add default database connection parameters + // if none given + _.defaults(req.params, { + dbuser: global.environment.postgres.user, + dbpassword: global.environment.postgres.password, + dbhost: global.environment.postgres.host, + dbport: global.environment.postgres.port + }); + + // FIXME: Temporary hack to share data between middlewares. Express overrides req.params to + // parse url params to an object and it's performed after matching path and controller. + _.defaults(req.locals, req.params); + + req.profiler.done('req2params'); + next(null, req); + } + ); + } + ]; };