koala-server - npm Package Compare versions

Comparing version 0.0.5 to 0.0.6

index.js

@@ -15,19 +15,21 @@ /* eslint-disable no-console */
 const bodyParser = require('body-parser')
+const configurePassport = require('./passport')
 
-const {
-  PORT,
-  NODE_ENV,
-  MONGO_URI,
-  COUCH_URI,
-  SESSION_SECRET,
-  JWT_SECRET,
-  APP_ORIGIN
-} = process.env
-
 /**
  * API keys and Passport configuration.
  */
-require('./passport')
 
-module.exports = function(apiDefinition) {
+module.exports = (config, apiDefinition) => {
+  const {
+    PORT,
+    NODE_ENV,
+    MONGO_URI,
+    COUCH_URI,
+    SESSION_SECRET,
+    JWT_SECRET,
+    APP_NAME,
+    APP_ORIGIN,
+    AUTH_PARTY,
+  } = config
+
   /**
@@ -51,3 +53,5 @@ * Create Express server.
 
+  // set up passport/auth
   // we only use cookies/sessions for OAuth + passport - after that we are using JWTs
+  configurePassport(config)
   app.use(session({
@@ -81,7 +85,8 @@ saveUninitialized: false,
    */
-  app.get('/auth/twitter', passport.authenticate('twitter'))
-  app.get('/auth/twitter/callback', passport.authenticate('twitter', { failureRedirect: '/auth/fail' }), (req, res, next) => {
+  const authCallback = (req, res, next) => {
     // create JSON web token for DB authentication later
+    const dbName = `${APP_NAME}-${req.user.username}`
     const payload = {
-      username: req.user.username
+      username: req.user.username,
+      dbName
     }
@@ -95,9 +100,9 @@ const token = jwt.sign(payload, JWT_SECRET, { expiresIn: '30d' })
       method: 'PUT',
-      url: `${COUCH_URI}/${req.user.username}`,
+      url: `${COUCH_URI}/${dbName}`,
     }).then(result => {
       const { status, body } = result
       if (status === 200 || status === 201) {
-        res.redirectBack(`action=signup&username=${req.user.username}&token=${token}`)
+        res.redirectBack(`action=signup&username=${req.user.username}&token=${token}&dbName=${dbName}`)
       } else if (status === 412) {
-        res.redirectBack(`action=login&username=${req.user.username}&token=${token}`)
+        res.redirectBack(`action=login&username=${req.user.username}&token=${token}&dbName=${dbName}`)
       } else {
@@ -107,4 +112,22 @@ res.status(status).send(body)
     }).catch(next)
-  })
+  }
 
+  app.get('/auth/twitter', passport.authenticate('twitter'))
+  app.get(
+    '/auth/twitter/callback',
+    passport.authenticate('twitter', { failureRedirect: '/auth/fail' }),
+    authCallback
+  )
+
+  if (AUTH_PARTY) {
+    app.get('/auth/party', (req, res, next) => {
+      req.user = {
+        username: 'authparty'
+      }
+      next()
+    },
+      authCallback
+    )
+  }
+
   app.get('/auth/fail', (req, res) => {
@@ -139,5 +162,7 @@ res.redirectBack('action=fail')
 
+    console.log(user)
+
     if (!user || !user.username) {
       res.status(401).send()
-    } else if (user.username !== req.params.db) {
+    } else if (user.dbName !== req.params.db) {
       res.status(401).send()
@@ -171,4 +196,5 @@ } else {
     console.log('App is running at http://localhost:%d in %s mode', PORT, NODE_ENV)
+    console.log('Config: ', config)
     console.log('  Press CTRL-C to stop\n')
   })
 }

package.json

 {
   "name": "koala-server",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "Your pouchdb backend aaS",
@@ -5,0 +5,0 @@ "main": "index.js",

passport/index.js

@@ -15,17 +15,41 @@ const passport = require('passport')
 
-passport.use(new TwitterStrategy({
-  consumerKey: process.env.TWITTER_KEY,
-  consumerSecret: process.env.TWITTER_SECRET,
-  callbackURL: `${process.env.KOALA_URI}/auth/twitter/callback`,
-  passReqToCallback: true
-}, (req, accessToken, tokenSecret, profile, done) => {
-  if (req.user) {
-    User.findOne({ twitter: profile.id }, (err, existingUser) => {
-      if (err) { return done(err) }
-      if (existingUser) {
-        done(err, existingUser)
+module.exports = (config) => {
+  const {
+    TWITTER_KEY,
+    TWITTER_SECRET,
+    KOALA_URI
+  } = config
+
+  if (TWITTER_KEY && TWITTER_SECRET) {
+    passport.use(new TwitterStrategy({
+      consumerKey: TWITTER_KEY,
+      consumerSecret: TWITTER_SECRET,
+      callbackURL: `${KOALA_URI}/auth/twitter/callback`,
+      passReqToCallback: true
+    }, (req, accessToken, tokenSecret, profile, done) => {
+      if (req.user) {
+        User.findOne({ twitter: profile.id }, (err, existingUser) => {
+          if (err) { return done(err) }
+          if (existingUser) {
+            done(err, existingUser)
+          } else {
+            User.findById(req.user.id, (err, user) => {
+              if (err) { return done(err) }
+              user.twitter = profile.id
+              user.tokens.push({ kind: 'twitter', accessToken, tokenSecret })
+              user.save((err) => {
+                done(err, user)
+              })
+            })
+          }
+        })
       } else {
-        User.findById(req.user.id, (err, user) => {
+        User.findOne({ twitter: profile.id }, (err, existingUser) => {
           if (err) { return done(err) }
+          if (existingUser) {
+            return done(null, existingUser)
+          }
+          const user = new User()
           user.twitter = profile.id
+          user.username = `twitter-${profile.username.toLowerCase()}`
           user.tokens.push({ kind: 'twitter', accessToken, tokenSecret })
@@ -37,18 +61,4 @@ user.save((err) => {
       }
-    })
-  } else {
-    User.findOne({ twitter: profile.id }, (err, existingUser) => {
-      if (err) { return done(err) }
-      if (existingUser) {
-        return done(null, existingUser)
-      }
-      const user = new User()
-      user.twitter = profile.id
-      user.username = `twitter-${profile.username.toLowerCase()}`
-      user.tokens.push({ kind: 'twitter', accessToken, tokenSecret })
-      user.save((err) => {
-        done(err, user)
-      })
-    })
+    }))
   }
-}))
+}

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Improved metrics

Total package byte prevSize

8523

increased by9.95%

Lines of code

236

increased by15.69%

Number of low supply chain risk alerts

0

decreased by-100%

No dependency changes