Add permissions and user menu

red/api/auth/index.js

@@ -18,23 +18,29 @@ var passport = require("passport");
 var oauth2orize = require("oauth2orize");
 
 var strategies = require("./strategies");
-var tokens = require("./tokens");
+var Tokens = require("./tokens");
+var Users = require("./users");
 
 var settings = require("../../settings");
 
 passport.use(strategies.bearerStrategy.BearerStrategy);
 passport.use(strategies.clientPasswordStrategy.ClientPasswordStrategy);
+passport.use(strategies.anonymousStrategy);
 
 var server = oauth2orize.createServer();
 
 server.exchange(oauth2orize.exchange.password(strategies.passwordTokenExchange));
 
+function init() {
+    Users.init();
+}
+
 function authenticate(req,res,next) {
     if (settings.adminAuth) {
         if (/^\/auth\/.*/.test(req.originalUrl)) {
             next();
         } else {
-            return passport.authenticate('bearer', { session: false })(req,res,next);
+            return passport.authenticate(['bearer','anon'], { session: false })(req,res,next); 
         }
     } else {
         next();
@@ -59,18 +65,18 @@ function login(req,res) {
         "type":"credentials",
         "prompts":[{id:"username",type:"text",label:"Username"},{id:"password",type:"password",label:"Password"}]
     }
-
     res.json(response);
 }
 
 function revoke(req,res) {
     var token = req.body.token;
-    tokens.revoke(token).then(function() {
+    Tokens.revoke(token).then(function() {
         res.send(200);
     });
 }
 
 module.exports = {
+    init: init,
     authenticate: authenticate,
     ensureClientSecret: ensureClientSecret,
     authenticateClient: authenticateClient,

red/api/auth/permissions.js

@@ -0,0 +1,50 @@
+/**
+ * Copyright 2014 IBM Corp.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+var util = require('util');
+
+var readRE = /^(.*)\.read$/
+var writeRE = /^(.*)\.write$/
+
+function needsPermission(perm) {
+    return function(req,res,next) {
+        if (!req.user) {
+            return next();
+        }
+        if (hasPermission(req.user,perm)) {
+            return next();
+        }
+        return res.send(401);
+    }
+}
+
+function hasPermission(user,permission) {
+    if (!user.permissions) {
+        return false;
+    }
+    if (user.permissions == "*") {
+        return true;
+    }
+    if (user.permissions == "read") {
+        return readRE.test(permission);
+    }
+}
+
+module.exports = {
+    hasPermission: hasPermission,
+    needsPermission: needsPermission,
+    
+}

red/api/auth/strategies.js

@@ -16,9 +16,10 @@
 
 var BearerStrategy = require('passport-http-bearer').Strategy;
 var ClientPasswordStrategy = require('passport-oauth2-client-password').Strategy;
+var passport = require("passport");
 
 var crypto = require("crypto");
-
+var util = require("util");
 var Tokens = require("./tokens");
 var Users = require("./users");
 var Clients = require("./clients");
@@ -29,7 +30,7 @@ var bearerStrategy = function (accessToken, done) {
         if (token) {
             Users.get(token.user).then(function(user) {
                 if (user) {
-                    done(null,{username:user.username},{scope:token.scope});
+                    done(null,user,{scope:token.scope});
                 } else {
                     done(null,false);
                 }
@@ -53,19 +54,38 @@ var clientPasswordStrategy = function(clientId, clientSecret, done) {
 clientPasswordStrategy.ClientPasswordStrategy = new ClientPasswordStrategy(clientPasswordStrategy);
 
 var passwordTokenExchange = function(client, username, password, scope, done) {
-  Users.get(username,password).then(function(user) {
+  Users.authenticate(username,password).then(function(user) {
       if (user) {
           Tokens.create(username,client.id,scope).then(function(token) {
               done(null,token);
           });
       } else {
-          done(new Error("Invalid"),false);
+          done(null,false);
       }
   });
 }
 
+
+function AnonymousStrategy() {
+  passport.Strategy.call(this);
+  this.name = 'anon';
+}
+util.inherits(AnonymousStrategy, passport.Strategy);
+AnonymousStrategy.prototype.authenticate = function(req) {
+    var authorization = req.headers['authorization'];
+    var self = this;
+    Users.anonymous().then(function(anon) {
+        if (anon) {
+            self.success(anon);
+        } else {
+            self.fail(401);
+        }
+    });
+}
+
 module.exports = {
     bearerStrategy: bearerStrategy,
     clientPasswordStrategy: clientPasswordStrategy,
-    passwordTokenExchange: passwordTokenExchange
+    passwordTokenExchange: passwordTokenExchange,
+    anonymousStrategy: new AnonymousStrategy()
 }

red/api/auth/users.js

@@ -19,30 +19,79 @@ var crypto = require("crypto");
 var util = require("util");
 
 var settings = require("../../settings");
+/*
+    adminAuth: {
+        type: "credentials",
+        users: [{
+            username: "nol",
+            password: "5f4dcc3b5aa765d61d8327deb882cf99" // password
+        }],
+        anonymous: {}
+    },
+    
+    adminAuth: {
+        type: "credentials",
+        api: {
+            get: function(username) {}
+            authenticate: function(username,password) {}
+            anonymous: function() {}
+        }
+*/
 
 //{username:"nick",password:crypto.createHash('md5').update("foo",'utf8').digest('hex')}
 var users = {};
 var passwords = {};
-var api = {};
+var anonymousUser = null;
 
-if (settings.adminAuth) {
-    if (settings.adminAuth.type == "credentials") {
-        if (settings.adminAuth.users) {
-            if (util.isArray(settings.adminAuth.users)) {
-                for (var i=0;i<settings.adminAuth.users.length;i++) {
-                    var u = settings.adminAuth.users[i];
-                    users[u.username] = {
-                        "username":u.username
-                    };
-                    passwords[u.username] = u.password;
+var api = {
+    get: function(username) {
+        return when.resolve(null);
+    },
+    authenticate: function(username,password) {
+        return when.resolve(null);
+    },
+    anonymous: function() {
+        return when.resolve(null);
+    }
+}
+function init() {
+    users = {};
+    passwords = {};
+    anonymousUser = null;
+    if (settings.adminAuth) {
+        if (settings.adminAuth.type == "credentials") {
+            if (settings.adminAuth.api) {
+                api.get = settings.adminAuth.api.get || api.get;
+                api.authenticate = settings.adminAuth.api.authenticate || api.authenticate;
+                api.anonymous = settings.adminAuth.api.anonymous || api.anonymous;
+            } else {
+                if (settings.adminAuth.users) {
+                    var us = settings.adminAuth.users;
+                    if (!util.isArray(us)) {
+                        us = [us];
+                    }
+                    for (var i=0;i<us.length;i++) {
+                        var u = us[i];
+                        users[u.username] = {
+                            "username":u.username,
+                            "permissions":u.permissions
+                        };
+                        passwords[u.username] = u.password;
+                    }
                 }
-                var api = {
+                if (settings.adminAuth.anonymous) {
+                    anonymousUser = {
+                        "anonymous": true,
+                        "permissions":settings.adminAuth.anonymous.permissions
+                    }
+                }
+                api = {
                     get: function(username) {
                         return when.resolve(users[username]);
                     },
                     authenticate: function(username,password) {
                         return api.get(username).then(function(user) {
-                            if (user) { 
+                            if (user) {
                                 var pass = crypto.createHash('md5').update(password,'utf8').digest('hex');
                                 if (pass == passwords[username]) {
                                     return when.resolve(user);
@@ -50,15 +99,20 @@ if (settings.adminAuth) {
                             }
                             return when.resolve(null);
                         });
+                    },
+                    anonymous: function() {
+                        return when.resolve(anonymousUser);
                     }
                 }
-            } else {
-                api = settings.adminAuth.users;
             }
         }
     }
 }
-
-module.exports = api;
+module.exports = {
+    init: init,
+    get: function(username) { return api.get(username) },
+    authenticate: function(username,password) { return api.authenticate(username,password) },
+    anonymous: function() { return api.anonymous(); }
+};