ben.carrasco/jambonz-api-server
1
0 Fork 0
mirror of https://github.com/jambonz/jambonz-api-server.git synced 2026-10-29 10:54:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

added more authentication tests

Browse Source
This commit is contained in:
Dave Horton committed 2019-12-05 15:11:53 -05:00
1 parent ce587d828f
commit c95a9ebaf7
7 files changed
+319 -23
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

lib/routes/api/api-keys.js
+10 -8
View File
@@ -11,18 +11,20 @@ const preconditions = {
};
function validateAddToken(req) {
if (req.user.hasScope('admin') && ('account_sid' in req.body)) {
// ok
req.body.token = uuidv4();
if (req.user.hasAdminAuth) return;
if (req.user.hasServiceProviderAuth) {
if (req.body.account_sid) delete req.body.service_provider_sid;
else req.body.service_provider_sid = req.user.service_provider_sid;
}
else if (req.user.hasScope('service_provider') &&
(!('account_sid' in req.body) && !('service_provider_sid' in req.body))) {
req.body['service_provider_sid'] = req.user.service_provider_sid;
}
else if (req.user.hasScope('account') && !req.user.hasScope('service_provider')) {
if (req.user.hasAccountAuth) {
if (req.body.account_sid !== req.user.account_sid) {
throw new DbErrorBadRequest('an account level token may not be used to create a token for a different account');
}
delete req.body['service_provider_sid'];
req.body['account_sid'] = req.user.account_sid;
}
req.body.token = uuidv4();
}
async function validateDeleteToken(req, sid) {