server/jwtBoardnameAuth.js

/**
 *                        WHITEBOPHIR
 *********************************************************
 * @licstart  The following is the entire license notice for the
 *  JavaScript code in this page.
 *
 * Copyright (C) 2013  Ophir LOJKINE
 *
 *
 * The JavaScript code in this page is free software: you can
 * redistribute it and/or modify it under the terms of the GNU
 * General Public License (GNU GPL) as published by the Free Software
 * Foundation, either version 3 of the License, or (at your option)
 * any later version.  The code is distributed WITHOUT ANY WARRANTY;
 * without even the implied warranty of MERCHANTABILITY or FITNESS
 * FOR A PARTICULAR PURPOSE.  See the GNU GPL for more details.
 *
 * As additional permission under GNU GPL version 3 section 7, you
 * may distribute non-source (e.g., minimized or compacted) forms of
 * that code without the copy of the GNU GPL normally required by
 * section 4, provided you include this license notice and a URL
 * through which recipients can access the Corresponding Source.
 *
 * @licend
 */

(config = require("./configuration.js")),
  (jsonwebtoken = require("jsonwebtoken"));

/**
 * This function checks if a board name is set in the roles claim.
 * Returns true of the board name is set in the JWT and the board name matches the board name in the URL
 * @param {string} url
 * @param {string} boardNameIn
 @returns {boolean} - True if user does not have the role forbidden false if the user hase the role forbidden
 @throws {Error} - If no boardname match
 */

function checkBoardnameInToken(url, boardNameIn) {
  var token = url.searchParams.get("token");
  if (roleInBoard(token, boardNameIn) === "forbidden") {
    throw new Error("Acess Forbidden");
  }
}

function parse_role(role) {
  let [_, role_name, board_name] = role.match(/^([^:]*):?(.*)$/);
  return { role_name, board_name };
}

/**
 * This function checks if a oard name is set in the roles claim.
 * Returns string depending on the role in the board
 * @param {string} token
 * @param {string} board
 @returns {string}  "moderator"|"editor"|"forbidden"
 */
function roleInBoard(token, board = null) {
  if (config.AUTH_SECRET_KEY != "") {
    if (!token) {
      throw new Error("No token provided");
    }
    var payload = jsonwebtoken.verify(token, config.AUTH_SECRET_KEY);

    var roles = payload.roles;
    var oneHasBoardName = false;
    var oneHasModerator = false;

    if (roles) {
      for (var line of roles) {
        var role = parse_role(line);

        if (role.board_name !== "") {
          oneHasBoardName = true;
        }
        if (role.role_name === "moderator") {
          oneHasModerator = true;
        }
        if (role.board_name === board) {
          return role.role_name;
        }
      }
      if ((!board && oneHasModerator) || !oneHasBoardName) {
        if (oneHasModerator) {
          return "moderator";
        } else {
          return "editor";
        }
      }
      return "forbidden";
    } else {
      return "editor";
    }
  } else {
    return "editor";
  }
}

module.exports = { checkBoardnameInToken, roleInBoard };