Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
githubId: request.pre.user.githubId,
key: request.pre.keyHash.key
}, Config.get('/jwtSecret'), { algorithm: 'HS256', expiresIn: "1m" });
const _id = request.pre.user._id;
const update = {
socialLoginHash: request.pre.keyHash.hash
};
// EXPL: We update the user's social Id just in case they didn't have one yet
if (request.pre.user.facebookId) { update.facebookId = request.pre.user.facebookId }
if (request.pre.user.googleId) { update.googleId = request.pre.user.googleId }
if (request.pre.user.githubId) { update.githubId = request.pre.user.githubId }
return RestHapi.update(User, _id, update, Log)
.then(function(user) {
const redirectUrl = clientURL + '/login/social';
return reply.redirect(redirectUrl + '/?token=' + token);
})
.catch(function (error) {
Log.error(error);
return reply(Boom.gatewayTimeout('An error occurred.'));
});
};
if (request.query.conversation) {
let me = result.users.find(function (user) {
return user._id.toString() === request.auth.credentials.user._id.toString()
})
if (!me) {
return reply(Boom.badRequest('Current user is not part of this conversation.'));
}
return result
}
else {
// EXPL: If the conversation doesn't exist, create it
if (!result.docs[0]) {
newConversation = true;
let promises = [];
let users = [request.auth.credentials.user._id, request.query.user];
promises.push(RestHapi.create(Conversation, { users, chatType: CHAT_TYPES.DIRECT }, Log));
promises.push(RestHapi.list(User, { _id: users, $select: ['_id', 'firstName', 'lastName', 'profileImageUrl'] }, Log));
return Q.all(promises);
}
else {
return result.docs[0];
}
}
})
.then(function(result) {
const recordVisitorHandler = async function(request, h) {
try {
// Specify the iplocation hosts to prevent issues (Ex: docker cant ping "https://ipaip.co/" by default)
// let hosts = ['freegeoip.net', 'ipapi.co']
// NOTE: Sign up for free access key at https://ipstack.com/
let host =
'http://api.ipstack.com/*?access_key=' +
Config.get('/ipstackAccessKey') +
'&format=1'
let result = await iplocation(server.methods.getIP(request), [host])
const agent = useragent.parse(request.headers['user-agent'])
const visitor = Object.assign(result, { browser: agent.family })
return RestHapi.create(Visitor, visitor, Log)
} catch (err) {
errorHelper.handleError(err, Log)
}
}
// Admins have access to any permission they can assign.
adminPermissions = permissions
.filter(function(p) {
return p.assignScope.indexOf(USER_ROLES.ADMIN) > -1
})
.map(function(p) {
return {
state: PERMISSION_STATES.INCLUDED,
childId: p._id
}
})
// Initial Admin role permissions
promises.push(
RestHapi.addMany(
models.role,
roles[1]._id,
models.permission,
'permissions',
adminPermissions,
Log
)
)
await Promise.all(promises)
promises = []
// Initial Super Admin role permissions
promises.push(
RestHapi.addMany(
models.role,
childId: p._id
}
})
let userPermissions = userBasePermissionNames.map(function(permissionName) {
return {
state: PERMISSION_STATES.INCLUDED,
childId: permissions.find(function (p) {
return p.name === permissionName
})._id
}
}).concat(userDocumentPermissions).concat(userImagePermissions)
// EXPL: initial User role permissions
promises.push(RestHapi.addMany(models.role, roles[0]._id, models.permission, 'permissions', userPermissions, Log))
return Q.all(promises)
.then(function (result) {
promises = []
// EXPL: Admins have access to any permission they can assign.
adminPermissions = permissions.filter(function(p) {
return p.assignScope.indexOf(USER_ROLES.ADMIN) > -1
}).map(function(p) {
return {
state: PERMISSION_STATES.INCLUDED,
childId: p._id
}
})
// EXPL: Initial Admin role permissions
.then(function (result) {
promises = []
// EXPL: Admins have access to any permission they can assign.
adminPermissions = permissions.filter(function(p) {
return p.assignScope.indexOf(USER_ROLES.ADMIN) > -1
}).map(function(p) {
return {
state: PERMISSION_STATES.INCLUDED,
childId: p._id
}
})
// EXPL: Initial Admin role permissions
promises.push(RestHapi.addMany(models.role, roles[1]._id, models.permission, 'permissions', adminPermissions, Log))
return Q.all(promises)
})
.then(function (result) {
.filter(function(p) {
// We start with permissions Admins can assign so that they will also be able to assign the group
return p.assignScope.indexOf(USER_ROLES.ADMIN) > -1
})
.filter(function(p) {
return p.name.includes('create')
})
.map(function(p) {
return {
state: PERMISSION_STATES.FORBIDDEN,
childId: p._id
}
})
promises.push(
RestHapi.addMany(
models.group,
groups[1]._id,
models.permission,
'permissions',
createForbiddenPermission,
Log
)
)
await Promise.all(promises)
promises = []
// Super User group permissions
let includedPermissions = permissionNames
.filter(function(permissionName) {
return permissionName !== 'root'
RestHapi.addMany(
models.role,
roles[1]._id,
models.permission,
'permissions',
adminPermissions,
Log
)
)
await Promise.all(promises)
promises = []
// Initial Super Admin role permissions
promises.push(
RestHapi.addMany(
models.role,
roles[2]._id,
models.permission,
'permissions',
[
{
state: PERMISSION_STATES.INCLUDED,
childId: permissions.find(function(p) {
return p.name === 'root'
})._id
}
],
Log
)
)
// Super User group permissions
let includedPermissions = permissionNames
.filter(function(permissionName) {
return permissionName !== 'root'
})
.map(function(permissionName) {
return {
state: PERMISSION_STATES.INCLUDED,
childId: permissions.find(function(p) {
return p.name === permissionName
})._id
}
})
promises.push(
RestHapi.addMany(
models.group,
groups[2]._id,
models.permission,
'permissions',
includedPermissions,
Log
)
)
await Promise.all(promises)
promises = []
// Assign groups to users
promises.push(
RestHapi.addMany(
models.user,
internals.canAssign = function(permissionId, userScope, mongoose, Log) {
const Permission = mongoose.model('permission');
return RestHapi.find(Permission, permissionId, {}, Log)
.then(function (result) {
let assignScope = result.assignScope;
// EXPL: Check if the user scope intersects (contains values of) the assign scope.
let canAssign = !!userScope.filter(scope => assignScope.indexOf(scope) > -1)[0]
return canAssign
})
.catch(function(error) {
Log.error("ERROR:", error)
return Boom.badRequest(error)
})
}