src/app.ts

@@ -1,17 +1,15 @@
 import "reflect-metadata";
 import * as dotenvSafe from "dotenv-safe";
-import { createExpressServer } from "routing-controllers";
+import { Action, createExpressServer, HttpError } from "routing-controllers";
 import consola from "consola";
 import loaders from "./loaders/index";
 import authchecker from "./authchecker";
-import { ErrorHandler } from './middlewares/ErrorHandler';
 // 
 dotenvSafe.config();
 const PORT = process.env.APP_PORT || 4010;
 
 const app = createExpressServer({
     authorizationChecker: authchecker,
-    middlewares: [ErrorHandler],
     development: false,
     controllers: [`${__dirname}/controllers/*.ts`],
 });

src/authchecker.ts

@@ -1,10 +1,10 @@
 import * as jwt from "jsonwebtoken";
-import { Action, HttpError } from "routing-controllers";
+import { Action, createExpressServer, HttpError } from "routing-controllers";
 // -----------
 const sampletoken = jwt.sign({
     "permissions": {
-        "TRACKS": ["read", "update", "delete", "add"]
+        // "TRACKS": ["read", "update", "delete", "add"]
-        // "TRACKS": []
+        "TRACKS": []
     }
 }, process.env.JWT_SECRET || "secretjwtsecret")
 console.log(`sampletoken: ${sampletoken}`);
@@ -18,27 +18,36 @@ const authchecker = async (action: Action, permissions: string | string[]) => {
     }
     // const token = action.request.headers["authorization"];
     const provided_token = action.request.query["auth"];
-    let jwtPayload = undefined
     try {
-        jwtPayload = <any>jwt.verify(provided_token, process.env.JWT_SECRET || "secretjwtsecret");
+        const jwtPayload = <any>jwt.verify(provided_token, process.env.JWT_SECRET || "secretjwtsecret");
+        if (jwtPayload.permissions) {
+            action.response.local = {}
+            action.response.local.jwtPayload = jwtPayload.permissions
+            required_permissions.forEach(r => {
+                const permission_key = r.split(":")[0]
+                const actual_accesslevel_for_permission = jwtPayload.permissions[permission_key]
+                console.log(actual_accesslevel_for_permission);
+                const permission_access_level = r.split(":")[1]
+                console.log(permission_key);
+                console.log(permission_access_level);
+                // console.log(permission_key);
+                // console.log(permission_access_level);
+                if (actual_accesslevel_for_permission.includes(permission_access_level)) {
+                    return true;
+                } else {
+                    // TODO: throw/return proper HttpError
+                    throw new HttpError(403, "no")
+                    return false;
+                }
+            });
+        } else {
+            // TODO: throw/return proper HttpError
+            return false;
+        }
     } catch (error) {
-        throw new HttpError(401, "jwt_illegal")
+        console.log(error);
-    }
+        // throw new HttpError(401, "jwt_illegal")
-    if (jwtPayload.permissions) {
+        return false
-        action.response.local = {}
-        action.response.local.jwtPayload = jwtPayload.permissions
-        required_permissions.forEach(r => {
-            const permission_key = r.split(":")[0]
-            const actual_accesslevel_for_permission = jwtPayload.permissions[permission_key]
-            const permission_access_level = r.split(":")[1]
-            if (actual_accesslevel_for_permission.includes(permission_access_level)) {
-                return true;
-            } else {
-                throw new HttpError(403, "no")
-            }
-        });
-    } else {
-        throw new HttpError(403, "no")
     }
     return true;
 }

src/controllers/TrackController.ts

@@ -25,7 +25,7 @@ class CreateTrack {
 }
 
 @JsonController("/track")
-// @Authorized("TRACKS:read")
+@Authorized("TRACKS:read")
 export class TrackController {
   private trackRepository: Repository<Track>;
 
@@ -45,7 +45,7 @@ export class TrackController {
     return this.trackRepository.findOne({ id: id });
   }
 
-  @Authorized()
+  @Authorized("TRACKS:write")
   @Post()
   post(@Body({ validate: true }) track: CreateTrack) {
     return this.trackRepository.save(track);

src/middlewares/ErrorHandler.ts

@@ -1,20 +0,0 @@
-import {
-    Middleware,
-    ExpressErrorMiddlewareInterface
-} from "routing-controllers";
-
-@Middleware({ type: "after" })
-export class ErrorHandler implements ExpressErrorMiddlewareInterface {
-    public error(
-        error: any,
-        request: any,
-        response: any,
-        next: (err: any) => any
-    ) {
-        if (response.headersSent) {
-            return;
-        }
-
-        response.json(error);
-    }
-}