[BUGFIX] (webida/webida-client#683) fix ACL bug

src/server/auth/auth.js

@@ -16,7 +16,6 @@
 
 'use strict';
 
-var util = require('util');
 var logger = require('../common/log-manager');
 var extend = require('../common/inherit').extend;
 var utils = require('../common/utils');
@@ -25,8 +24,6 @@ var baseSvc = require('../common/n-svc').Svc;
 var express = require('express');
 
 var session    = require('express-session');
-//var MongoStore = require('connect-mongo')(session);
-var FileStore = require('session-file-store')(session);
 var SQLiteStore = require('connect-sqlite3')(session);
 var passport = require('passport');
 var corser = require('corser');
@@ -42,22 +39,12 @@ var morgan = require('morgan');
 var cookieParser = require('cookie-parser');
 var bodyParser = require('body-parser');
 
-var multipart = require('connect-multiparty');
-var multipartMiddleware = multipart();
-
-
 var config = global.app.config;
 
-function setXFrameOption (req, res, next) {
-    res.setHeader('X-Frame-Options', 'DENY');
-    next();
-}
-
 var register = function (auth, conf, unitName, svcType) {
     auth.set('views', __dirname + '/views');
     auth.set('view engine', 'ejs');
 
-    //auth.use(setXFrameOption);
     auth.use(compression());
     auth.use(express.static(__dirname + '/views'));
 
@@ -72,7 +59,14 @@ var register = function (auth, conf, unitName, svcType) {
     auth.use(corser.create(
         {
             methods: ['GET', 'POST', 'DELETE'],
-            requestHeaders: ['Authorization', 'Accept', 'Accept-Language', 'Content-Language', 'Content-Type', 'Last-Event-ID'],
+            requestHeaders: [
+                'Authorization',
+                'Accept',
+                'Accept-Language',
+                'Content-Language',
+                'Content-Type',
+                'Last-Event-ID'
+            ],
             supportsCredentials: true,
             maxAge: 86400  // as 1 day
         }
@@ -110,11 +104,9 @@ var register = function (auth, conf, unitName, svcType) {
     auth.use(user.router);
     auth.use(acl.router);
     auth.use(group.router);
-    auth.use(function(err, req, res, next) {
+    auth.use(function(err, req, res) {
         logger.debug('errorHandler middleware', err);
-
         res.status(500).send('Internal server error');
-        //res.send(500, 'Internal server error');
     });
     auth.disable('x-powered-by');
 };
@@ -165,7 +157,7 @@ AuthSvr.prototype.start = function () {
         logger.info('authorization https server is started at port ' + conf.httpsPort);
     }
 
-}
+};
 
 AuthSvr.prototype.stop = function () {
     var self = this;
@@ -180,7 +172,7 @@ AuthSvr.prototype.stop = function () {
     }
 
     require('./lib/userdb').close();
-}
+};
 
 //
 // AuthSvc
@@ -200,22 +192,20 @@ extend(AuthSvc, baseSvc);
 AuthSvc.prototype.start = function () {
     var self = this;
     self.authSvr.start();
-}
+};
 
 AuthSvc.prototype.stop = function () {
     var self = this;
     self.authSvr.stop();
-}
+};
 
 AuthSvc.prototype.started = function () {
 
-}
+};
 
 AuthSvc.prototype.stopped = function () {
 
-}
-
-
-exports.Svc = AuthSvc
+};
 
+exports.Svc = AuthSvc;
 

src/server/auth/lib/oauth2-manager.js

@@ -138,6 +138,7 @@ router.get('/webida/api/oauth/authorize',
         });
     }),
     function (req, res, next) {
+        /*jshint camelcase: false */
         var allow = { uid: req.user.uid,
                       client: req.oauth2.client.clientID,
                       transaction_id: req.oauth2.transactionID };
@@ -153,11 +154,15 @@ router.get('/webida/api/oauth/authorize',
                     client: req.oauth2.client,
                     isDevClient: false /*isDevClient*/ });
         }
+        /*jshint camelcase: true */
     },
+    /*jshint unused:false*/
+    // Once `next` is removed, the action of this method is getting weired.
     function(err, req, res, next) {
         logger.error('authorization err: ', err);
         res.sendErrorPage(401, err);
     },
+    /*jshint unused:true*/
     server.decision()
 );
 
@@ -170,7 +175,9 @@ router.post('/oauth/decision',
             req.body.allow === 'on' ? true : false);
 
         */
+        /*jshint camelcase: false */
         req.body.transaction_id = req.session.allow.transaction_id;
+        /*jshint camelcase: true */
 
         next();
     },
@@ -226,7 +233,7 @@ router.get('/webida/api/oauth/verify',
 router.post('/webida/api/oauth/personaltoken',
     userdb.verifyToken,
     function (req, res, next) {
-        var aclInfo = {uid: req.user.uid, action: 'auth:addNewPersonalToken', rsc: 'auth:*'};
+        var aclInfo = {uid: req.user.uid, action: 'auth:addNewPersonalToken', rsc: 'auth:' + req.user.userId};
         userdb.checkAuthorize(aclInfo, function (err) {
             if (!err) {
                 return next();
@@ -251,7 +258,7 @@ router.post('/webida/api/oauth/personaltoken',
 router['delete']('/webida/api/oauth/personaltoken/:personaltoken',
     userdb.verifyToken,
     function (req, res, next) {
-        var aclInfo = {uid: req.user.uid, action: 'auth:deletePersonalToken', rsc: 'auth:*'};
+        var aclInfo = {uid: req.user.uid, action: 'auth:deletePersonalToken', rsc: 'auth:' + req.user.userId};
         userdb.checkAuthorize(aclInfo, function (err) {
             if (!err) {
                 return next();
@@ -278,7 +285,7 @@ router['delete']('/webida/api/oauth/personaltoken/:personaltoken',
 router.get('/webida/api/oauth/personaltoken',
     userdb.verifyToken,
     function (req, res, next) {
-        var aclInfo = {uid: req.user.uid, action: 'auth:getPersonalTokens', rsc: 'auth:*'};
+        var aclInfo = {uid: req.user.uid, action: 'auth:getPersonalTokens', rsc: 'auth:' + req.user.userId};
         userdb.checkAuthorize(aclInfo, function (err) {
             if (!err) {
                 return next();