78 lines
2.1 KiB
JavaScript
Raw Normal View History

2018-08-08 17:57:02 +02:00
const _ = require('lodash');
module.exports = async (ctx, next) => {
let role;
if (ctx.request && ctx.request.header && ctx.request.header.authorization) {
try {
2018-01-18 11:13:44 +01:00
const { _id, id } = await strapi.plugins['users-permissions'].services.jwt.getToken(ctx);
if ((id || _id) === undefined) {
throw new Error('Invalid token: Token did not contain required fields');
}
2017-12-14 16:12:39 +01:00
ctx.state.user = await strapi.query('user', 'users-permissions').findOne({ _id, id });
} catch (err) {
return handleErrors(ctx, err, 'unauthorized');
}
if (!ctx.state.user) {
return handleErrors(ctx, 'User Not Found', 'unauthorized');
}
role = ctx.state.user.role;
if (role.type === 'root') {
return await next();
}
2018-08-08 17:57:02 +02:00
const store = await strapi.store({
environment: '',
type: 'plugin',
name: 'users-permissions'
});
2019-02-28 19:22:01 +02:00
if (_.get(await store.get({key: 'advanced'}), 'email_confirmation') && !ctx.state.user.confirmed) {
return handleErrors(ctx, 'Your account email is not confirmed.', 'unauthorized');
2018-08-08 17:57:02 +02:00
}
2018-10-31 17:20:09 +01:00
2019-02-28 19:22:01 +02:00
if (ctx.state.user.blocked) {
return handleErrors(ctx, 'Your account has been blocked by the administrator.', 'unauthorized');
2018-08-06 17:46:58 +02:00
}
}
2018-03-12 16:37:20 +01:00
// Retrieve `public` role.
if (!role) {
2018-03-12 16:37:20 +01:00
role = await strapi.query('role', 'users-permissions').findOne({ type: 'public' }, []);
}
const route = ctx.request.route;
const permission = await strapi.query('permission', 'users-permissions').findOne({
role: role._id || role.id,
type: route.plugin || 'application',
controller: route.controller,
action: route.action,
enabled: true
}, []);
if (!permission) {
return handleErrors(ctx, undefined, 'forbidden');
}
// Execute the policies.
if (permission.policy) {
return await strapi.plugins['users-permissions'].config.policies[permission.policy](ctx, next);
}
// Execute the action.
await next();
};
const handleErrors = (ctx, err = undefined, type) => {
if (ctx.request.graphql === null) {
return ctx.request.graphql = strapi.errors[type](err);
}
return ctx[type](err);
2019-02-28 19:22:01 +02:00
};