summaryrefslogtreecommitdiff
path: root/src/api
diff options
context:
space:
mode:
authorsyuilo <syuilotan@yahoo.co.jp>2017-01-06 12:09:57 +0900
committersyuilo <syuilotan@yahoo.co.jp>2017-01-06 12:09:57 +0900
commitfef3d3f300c80bf26b0c6a203db5782f76463151 (patch)
tree4b590d2c11e2d1f031cc3fff9ef1c9c76741cdc6 /src/api
parent[BREAKING CHANGE] Improve security (diff)
downloadsharkey-fef3d3f300c80bf26b0c6a203db5782f76463151.tar.gz
sharkey-fef3d3f300c80bf26b0c6a203db5782f76463151.tar.bz2
sharkey-fef3d3f300c80bf26b0c6a203db5782f76463151.zip
Refactor: Rename userkey --> access-token
Diffstat (limited to 'src/api')
-rw-r--r--src/api/authenticate.ts12
-rw-r--r--src/api/endpoints/auth/accept.js24
-rw-r--r--src/api/endpoints/auth/session/userkey.js8
-rw-r--r--src/api/models/access-token.ts6
-rw-r--r--src/api/models/userkey.ts5
-rw-r--r--src/api/serializers/app.ts4
-rw-r--r--src/api/streaming.ts10
7 files changed, 35 insertions, 34 deletions
diff --git a/src/api/authenticate.ts b/src/api/authenticate.ts
index 0a888e72d3..2304acff21 100644
--- a/src/api/authenticate.ts
+++ b/src/api/authenticate.ts
@@ -1,7 +1,7 @@
import * as express from 'express';
import App from './models/app';
import User from './models/user';
-import Userkey from './models/userkey';
+import AccessToken from './models/access-token';
import isNativeToken from './common/is-native-token';
export interface IAuthContext {
@@ -42,19 +42,19 @@ export default (req: express.Request) => new Promise<IAuthContext>(async (resolv
isSecure: true
});
} else {
- const userkeyDoc = await Userkey.findOne({
+ const accessToken = await AccessToken.findOne({
hash: token
});
- if (userkeyDoc === null) {
- return reject('invalid userkey');
+ if (accessToken === null) {
+ return reject('invalid token');
}
const app = await App
- .findOne({ _id: userkeyDoc.app_id });
+ .findOne({ _id: accessToken.app_id });
const user = await User
- .findOne({ _id: userkeyDoc.user_id });
+ .findOne({ _id: accessToken.user_id });
return resolve({ app: app, user: user, isSecure: false });
}
diff --git a/src/api/endpoints/auth/accept.js b/src/api/endpoints/auth/accept.js
index 9eb5d2e7e2..110a0897df 100644
--- a/src/api/endpoints/auth/accept.js
+++ b/src/api/endpoints/auth/accept.js
@@ -7,7 +7,7 @@ import rndstr from 'rndstr';
const crypto = require('crypto');
import App from '../../models/app';
import AuthSess from '../../models/auth-session';
-import Userkey from '../../models/userkey';
+import AccessToken from '../../models/access-token';
/**
* Accept
@@ -20,24 +20,24 @@ module.exports = (params, user) =>
new Promise(async (res, rej) =>
{
// Get 'token' parameter
- const token = params.token;
- if (token == null) {
+ const sesstoken = params.token;
+ if (sesstoken == null) {
return rej('token is required');
}
// Fetch token
const session = await AuthSess
- .findOne({ token: token });
+ .findOne({ token: sesstoken });
if (session === null) {
return rej('session not found');
}
- // Generate userkey
- const key = rndstr('a-zA-Z0-9', 32);
+ // Generate access token
+ const token = rndstr('a-zA-Z0-9', 32);
- // Fetch exist userkey
- const exist = await Userkey.findOne({
+ // Fetch exist access token
+ const exist = await AccessToken.findOne({
app_id: session.app_id,
user_id: user._id,
});
@@ -50,15 +50,15 @@ module.exports = (params, user) =>
// Generate Hash
const sha512 = crypto.createHash('sha512');
- sha512.update(key + app.secret);
+ sha512.update(token + app.secret);
const hash = sha512.digest('hex');
- // Insert userkey doc
- await Userkey.insert({
+ // Insert access token doc
+ await AccessToken.insert({
created_at: new Date(),
app_id: session.app_id,
user_id: user._id,
- key: key,
+ token: token,
hash: hash
});
}
diff --git a/src/api/endpoints/auth/session/userkey.js b/src/api/endpoints/auth/session/userkey.js
index 2626e4ce39..f85a720ea4 100644
--- a/src/api/endpoints/auth/session/userkey.js
+++ b/src/api/endpoints/auth/session/userkey.js
@@ -5,7 +5,7 @@
*/
import App from '../../../models/app';
import AuthSess from '../../../models/auth-session';
-import Userkey from '../../../models/userkey';
+import AccessToken from '../../../models/access-token';
import serialize from '../../../serializers/user';
/**
@@ -53,8 +53,8 @@ module.exports = (params) =>
return rej('this session is not allowed yet');
}
- // Lookup userkey
- const userkey = await Userkey.findOne({
+ // Lookup access token
+ const accessToken = await AccessToken.findOne({
app_id: app._id,
user_id: session.user_id
});
@@ -66,7 +66,7 @@ module.exports = (params) =>
// Response
res({
- userkey: userkey.key,
+ access_token: accessToken.token,
user: await serialize(session.user_id, null, {
detail: true
})
diff --git a/src/api/models/access-token.ts b/src/api/models/access-token.ts
new file mode 100644
index 0000000000..f94df954d6
--- /dev/null
+++ b/src/api/models/access-token.ts
@@ -0,0 +1,6 @@
+const collection = global.db.collection('access_tokens');
+
+collection.createIndex('token');
+collection.createIndex('hash');
+
+export default collection;
diff --git a/src/api/models/userkey.ts b/src/api/models/userkey.ts
deleted file mode 100644
index 204f283a28..0000000000
--- a/src/api/models/userkey.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-const collection = global.db.collection('userkeys');
-
-collection.createIndex('key');
-
-export default collection;
diff --git a/src/api/serializers/app.ts b/src/api/serializers/app.ts
index 1c4b244a36..b60bcb97e6 100644
--- a/src/api/serializers/app.ts
+++ b/src/api/serializers/app.ts
@@ -7,7 +7,7 @@ import * as mongo from 'mongodb';
import deepcopy = require('deepcopy');
import App from '../models/app';
import User from '../models/user';
-import Userkey from '../models/userkey';
+import AccessToken from '../models/access-token';
/**
* Serialize an app
@@ -71,7 +71,7 @@ export default (
if (me) {
// 既に連携しているか
- const exist = await Userkey.count({
+ const exist = await AccessToken.count({
app_id: _app.id,
user_id: me,
}, {
diff --git a/src/api/streaming.ts b/src/api/streaming.ts
index dd28a0bc1e..49269ac445 100644
--- a/src/api/streaming.ts
+++ b/src/api/streaming.ts
@@ -2,7 +2,7 @@ import * as http from 'http';
import * as websocket from 'websocket';
import * as redis from 'redis';
import User from './models/user';
-import Userkey from './models/userkey';
+import AccessToken from './models/access-token';
import isNativeToken from './common/is-native-token';
import homeStream from './stream/home';
@@ -63,18 +63,18 @@ function authenticate(connection: websocket.connection, token: string): Promise<
resolve(user);
} else {
- const userkey = await Userkey.findOne({
+ const accessToken = await AccessToken.findOne({
hash: token
});
- if (userkey == null) {
- return reject('invalid userkey');
+ if (accessToken == null) {
+ return reject('invalid token');
}
// Fetch user
// SELECT _id
const user = await User
- .findOne({ _id: userkey.user_id }, {
+ .findOne({ _id: accessToken.user_id }, {
_id: true
});