Merge pull request #195 from hicsail/tokenpermission

Tokenpermission

server/auth.js

@@ -65,8 +65,8 @@ const register = function (server, options) {
         return { isValid: false };
       }
 
-      if (!await confirmPermission(request,user)) {
-        throw Boom.forbidden('Need permission');
+      if (!confirmTokenPermission(request,token)) {
+        throw Boom.forbidden('Insufficient token permissions');
       }
 
       if (await Crypto.compare(password,token.key)){
@@ -152,17 +152,30 @@ const usersPermissions = async function (user) {
   return permissions;
 };
 
+const pathToKey = function (request) {
+
+  const method = request.method.toUpperCase();
+  const path = request.path.split('/').join('-');
+  return method + '-' + path;
+};
+
+const confirmTokenPermission = function (request,token) {
+
+  const key = pathToKey(request);
+  if (token.permissions[key] !== undefined) {
+    return token.permissions[key];
+  }
+  return true;
+};
+
 const confirmPermission = async function (request,user) {
 
-  const method = String(request.method).toUpperCase();
-  const incompletePath = String(request.path).split('/').join('-');
-  const key = method + incompletePath;
+  const key = pathToKey(request);
   const permissions = await usersPermissions(user);
 
   if (permissions[key] !== undefined) {
     return permissions[key];
   }
-
   return true;
 };
 
@@ -176,5 +189,6 @@ module.exports = {
   ],
   register,
   usersPermissions,
-  confirmPermission
+  confirmPermission,
+  confirmTokenPermission
 };