Merge pull request #10 from neonexus/master

Created API token handling. Added <noscript> tags.

Author: neonexus

api/controllers/admin/create-api-token.js

@@ -1,7 +1,7 @@
 module.exports = {
     friendlyName: 'Create API Token',
 
-    description: 'Get an API token, which replaces CSRF token usage.',
+    description: 'Get an API token, which replaces CSRF token / session cookie usage.',
 
     inputs: {},
 
@@ -17,8 +17,15 @@ module.exports = {
         }
     },
 
-    fn: (inputs, exits) => {
+    fn: async (inputs, exits, env) => {
+        const newToken = await ApiToken.create({
+            id: 'c', // required, auto-generated
+            user: env.req.session.user.id
+        }).fetch();
 
-        return exits.ok();
+        return exits.ok({
+            token: newToken.token,
+            __skipCSRF: true
+        });
     }
 };

api/controllers/admin/login.js

@@ -46,7 +46,7 @@ module.exports = {
             return exits.badRequest(badEmailPass);
         }
 
-        const csrf = sails.helpers.generateCsrfToken();
+        const csrf = sails.helpers.generateCsrfTokenAndSecret();
         const newSession = await Session.create({
             id: 'c', // required, auto-generated
             user: foundUser.id,

api/helpers/generate-uuid.js

@@ -1,4 +1,4 @@
-const { v4: uuidv4 } = require('uuid');
+const {v4: uuidv4} = require('uuid');
 
 module.exports = {
     friendlyName: 'Generate UUID',

api/helpers/is-email.js

@@ -16,7 +16,7 @@ module.exports = {
         success: {}
     },
 
-    fn: function(inputs, exits){
+    fn: function(inputs, exits) {
         // eslint-disable-next-line no-useless-escape
         const emailRegex = /^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
 

api/helpers/is-password-valid.js

@@ -16,16 +16,12 @@ module.exports = {
 
     sync: true,
 
-    fn: function(inputs, exits){
+    fn: function(inputs, exits) {
         let errors = [],
             isPassPhrase = false;
 
-        if (!inputs.password) {
-            return ['Password can not be empty'];
-        }
-
         if (inputs.password.length < 7) {
-            errors.push('Password must be at least 8 characters');
+            errors.push('Password must be at least 7 characters');
         }
 
         if (inputs.password.length > 70) {

api/helpers/set-or-remove-cookies.js

@@ -41,11 +41,11 @@ module.exports = {
                         : [inputs.data.cookies];
 
         cookies.map((cookie) => {
-            if (!_.isDefined(cookie.name) || !_.isString(cookie.name) || _.isEmpty(cookie.name)) {
+            if (_.isUndefined(cookie.name) || !_.isString(cookie.name) || _.isEmpty(cookie.name)) {
                 throw 'missingName';
             }
 
-            if (!_.isDefined(cookie.value)) {
+            if (_.isUndefined(cookie.value)) {
                 throw 'missingValue';
             }
 

api/helpers/update-csrf.js

@@ -23,8 +23,8 @@ module.exports = {
 
     fn: async (inputs, exits) => {
         // Do nothing if we don't have a session, or this is a GET request.
-        if (inputs.req.method === 'GET' || !inputs.req.session || !inputs.req.session.user || !inputs.req.session.id) {
-            return exits.success(inputs.data);
+        if (inputs.req.method === 'GET' || !inputs.req.session || !inputs.req.session.user || !inputs.req.session.id || inputs.data.__skipCSRF) {
+            return exits.success(_.omit(inputs.data, ['__skipCSRF']));
         }
 
         const foundSession = await Session.findOne({id: inputs.req.session.id});

api/hooks/request-logger.js

@@ -3,7 +3,7 @@ const stringify = require('json-stringify-safe');
 module.exports = (sails) => {
     return {
 
-        initialize: function (cb) {
+        initialize: function(cb) {
             // Assign this hook object to the `hook` var.
             // This allows us to add/modify values that users of the hook can retrieve.
             //hook = this;
@@ -17,7 +17,7 @@ module.exports = (sails) => {
 
         routes: {
             before: {
-                '*': function (req, res, next) {
+                '*': function(req, res, next) {
                     if (req.method !== 'HEAD' && req.path !== '/__getcookie' && req.path !== '/') {
                         const bleep = '*******';
 

api/models/ApiToken.js

@@ -0,0 +1,40 @@
+module.exports = {
+    primaryKey: 'id',
+
+    attributes: {
+        id: {
+            type: 'string',
+            columnType: 'varchar(36)',
+            required: true
+        },
+
+        token: {
+            type: 'string',
+            unique: true
+        },
+
+        user: {
+            model: 'user',
+            required: true
+        },
+
+        createdAt: {
+            type: 'ref',
+            columnType: 'datetime',
+            autoCreatedAt: true
+        },
+
+        updatedAt: {
+            type: 'ref',
+            columnType: 'datetime',
+            autoUpdatedAt: true
+        }
+    },
+
+    beforeCreate: (obj, next) => {
+        obj.id = sails.helpers.generateUuid();
+        obj.token = sails.helpers.generateToken();
+
+        return next();
+    }
+};

api/policies/isLoggedIn.js

@@ -20,6 +20,26 @@ module.exports = async function(req, res, next) {
 
         // Doesn't look like this session is valid, remove the cookie.
         res.clearCookie(sails.config.session.name, {signed: true, httpOnly: true, secure: sails.config.session.cookie.secure});
+    } else {
+        let token = req.headers['authorization'];
+
+        if (token.includes('Bearer ')) {
+            token = token.substring(7);
+        }
+
+        const foundToken = await sails.models.apitoken.findOne({
+            token
+        }).populate('user');
+
+        if (foundToken) {
+            await sails.models.apitoken.updateOne({
+                token
+            }).set({updatedAt: new Date()});
+
+            req.session = {user: foundToken.user};
+
+            return next();
+        }
     }
 
     return res.forbidden('You are not logged in');