Unauthorized access

[rub-sky]

No description provided.

[coveralls]

Changes Unknown when pulling d741140 on UnauthorizedAccess into * on development*.

[chances]

Why was sinon added?

[chances]

This comment is superfluous. The next callback is an express paradigm

[chances]

The authentication status shouldn't be added to the session because this is middleware. If the middleware is added as ap-wide middleware, then the status is checked for every request and should be added to the request object. Conversely, if it is only route-specific middleware, the same thing applies because the check will be run anyway.

[chances]

The authentication check doesn't need to send a request to Jama. (Nor should it, it creates a large amount of overhead on requests that depend on the middleware.)

We know a user is authenticated if both a session exists with username, password, and project keys and the current session is not expired. The session is only populated with those keys upon successful authentication and is destroyed on logout.

All that is needed is to check that those keys exist on the session.

[rub-sky]

@chances, the authentication status should be added as a global variable instead of session variable? Last time we talked about this you mentioned that the middleware should be route specific and each page will handle the check result.

[rub-sky]

We used sinon for stubbing.

[RickyV33]

You just need to check if the session fields aren't falsey here, you don't have to make a request to jama. teamName is stored in .env in so you don't need to check the req.session.teamName field for that.

Then you can store the actual result in the req object so we can check it in the routes.

req.isAuthenticated = isAuth;

[RickyV33]

Now that it's using the middleware isAuthenticated, it's setting the req.isAuthenticated to true or false. Check that value and only do the work if it's true in the routes that matter such as project/get or graph/get (the else statement)

so...

// in projects
router.get('/', auth.isAuthenticated.....) {
if (req.isAuthenitcated) {
 render.res...
}
}

etc.

[chances]

sinon-chai is unused, remove it.