api/utils/authorizer

Module providing one time authentication

Description:

  • Module providing one time authentication

Source:

Members

(inner) ENDPOINT_PARAM_KEY

Description:

  • A literal query string key and value an endpointquery entry may require.

Source:

A literal query string key and value an endpointquery entry may require.

Methods

(static) check_if_expired(options)

Description:

  • Checks if token is not expired yet

Source:
Parameters:
Name Type Description
options object

options for the task

Properties
Name Type Description
db object

database connection
token string

token to rvalidate
callback function

function called when reading was completed or errored, providing error object as first param, true or false if expired as second, seconds till expiration as third.(-1 if never expires, 0 - if expired)

(static) clean(options)

Description:

  • Clean all expired tokens

Source:
Parameters:
Name Type Description
options object

options for the task

Properties
Name Type Description
db object

database connection
callback function

function called when cleaning completed

(static) extend_token(options)

Description:

  • extent token life spas

Source:
Parameters:
Name Type Description
options object

options for the task

Properties
Name Type Description
db object

database connection
token string

token to extend
extendBy string

extend token by given time(in ms)(optional) You have to provide extedBy or extendTill. extendBy==0 makes it never die
extendTill string

extend till given timestamp. (optional) You have to provide extedBy or extendTill
callback function

function called when reading was completed or errored, providing error object as first param and true as second if extending successful

(static) getToken() → {string}

Description:

  • Generates auhtentication ID

Source:
Returns:

id to be used when saving the task

Type
string

(static) read(options)

Description:

  • Get whole token information from database

Source:
Parameters:
Name Type Description
options object

options for the task

Properties
Name Type Description
db object

database connection
token string

token to read
callback function

function called when reading was completed or errored, providing error object as first param and token object from database as second

(static) revokeMemberTokens(options) → {Promise}

Description:

  • Revoke the tokens a member owns. Used when a member signs out (purpose LoggedInAuth only) and when their password changes (every token, of any purpose). The owner is matched as a string, because save() stores it as one.

Source:
Parameters:
Name Type Description
options object

options for the task

Properties
Name Type Attributes Description
db object <optional>

database connection
owner string | object

id of the member whose tokens are revoked
purpose string <optional>

only revoke tokens with this purpose; every token when omitted
keepToken string <optional>

token to keep, such as the one of the current session
Returns:

resolves once the tokens are removed

Type
Promise

(static) save(options)

Description:

  • Store token for later authentication

Source:
Parameters:
Name Type Description
options object

options for the task

Properties
Name Type Attributes Default Description
db object

database connection
ttl number

amount of seconds for token to work, 0 works indefinately
multi boolean <optional>
 false

if true, can be used many times until expired
token string

token to store, if not provided, will be generated
owner string

id of the user who created this token
app string

list of the apps for which token was created
endpoint string

regexp of endpoint(any string - is used as substring,to mach exact ^{yourpath}$). Deprecated as an authorization mechanism, kept for tokens created before the permission model.
token_permission object <optional>

CRUD permissions granted to this token, in the same shape as member.permission ({_:{a,u}, c/r/u/d:{appId:{all, allowed}}}). When set, the token authorizes only the intersection of this object and its owner's own permissions. When omitted, the token inherits the owner's full permissions.
can_login boolean <optional>
 false

if true, the token may be redeemed for a dashboard session at /login/token. SERVER-ASSIGNED ONLY - see the note below.
tryReuse string

if true - tries to find not expired token with same parameters. If not founds cretes new token. If found - updates token expiration time to new one and returns token.
temporary boolean <optional>
 false

If logged in with temporary token. Doesn't kill other sessions on logout.
callback function

function called when saving was completed or errored, providing error object as first param and token string as second

(static) verify(options)

Description:

  • Verify token and expire it

Source:
Parameters:
Name Type Description
options object

options for the task

Properties
Name Type Description
db object

database connection
token string

token to verify
qstring string

params.qstring. If not passed and there is limitation for this token on params - token will not be valid
req_path string

current request path
callback function

function called when verifying was completed, providing 1 argument, true if could verify token and false if couldn't

(static) verify_return(options)

Description:

  • Similar to authorizer.verify. Only difference - return token owner if valid.

Source:
Parameters:
Name Type Description
options object

options for the task

Properties
Name Type Description
db object

database connection
token string

token to verify
qstring string

params.qstring. If not passed and there is limitation for this token on params - token will not be valid
req_path string

current request path
callback function

function called when verifying was completed, providing 1 argument, true if could verify token and false if couldn't

(inner) isLiteralEndpointPath(path) → {boolean}

Description:

  • Whether a value is a literal API path a new token may be restricted to: a leading slash and at least two non-empty segments of letters, digits, "_" and "-". Nothing else, so no regex syntax, no wildcard and no path that covers a whole tree ("/", "/o").

Source:
Parameters:
Name Type Description
path string

requested endpoint
Returns:

true if it is a literal API path

Type
boolean

(inner) parseEndpointRestriction(endpointParam, endpointQueryParam) → {Object}

Description:

  • Parse the endpoint restriction a request asks a new token to carry.

    Stored endpoints are regexes matched from the start of the request path, so a value such as "", "/o" or ".*" would cover every path or a whole tree. A new token therefore names concrete paths only, and each is stored anchored at both ends, so "/o/actions" matches /o/actions and nothing else. An endpointquery entry is validated the same way, and the query string values it requires are matched exactly. Tokens stored before keep their own matching.

Source:
Parameters:
Name Type Description
endpointParam string | undefined

comma separated paths (the endpoint parameter)
endpointQueryParam string | undefined

JSON array of {endpoint, params} (the endpointquery parameter)
Returns:

the endpoint field to store ("" for none), or an error

Type
Object

(inner) verify_token(options, return_owner, return_data)

Description:

  • Token validation function called from verify and verify return

Source:
Parameters:
Name Type Description
options object

options for the task

Properties
Name Type Description
db object

database connection
token string

token to validate
qstring string

params.qstring. If not passed and there is limitation for this token on params - token will not be valid
callback function

function called when verifying was completed or errored, providing error object as first param and true as second if extending successful
return_owner boolean

states if in callback owner shold be returned. If return_owner==false, returns true or false.
return_data boolean

states if in callback all token data should be returned.