initial commit after fork of passport-socketio

lib/UnauthorizedError.js

@@ -0,0 +1,11 @@
+function UnauthorizedError (code, error) {
+  Error.call(this, error.message);
+  this.message = error.message;
+  this.code = code;
+  this.inner = error;
+}
+
+UnauthorizedError.prototype = Object.create(Error.prototype);
+UnauthorizedError.prototype.constructor = UnauthorizedError;
+
+module.exports = UnauthorizedError;

lib/index.js

@@ -1,71 +1,62 @@
 var xtend = require('xtend');
-
-function parseCookie(auth, cookieHeader) {
-  var cookieParser = auth.cookieParser(auth.secret);
-  var req = {
-    headers:{
-      cookie: cookieHeader
-    }
-  };
-  var result;
-  cookieParser(req, {}, function (err) {
-    if (err) throw err;
-    result = req.signedCookies;
-  });
-  return result;
-}
+var jwt = require('jsonwebtoken');
+var UnauthorizedError = require('./UnauthorizedError');
+var url = require('url');
 
 function authorize(options) {
   var defaults = {
-    passport:     require('passport'),
-    key:          'connect.sid',
-    secret:       null,
-    store:        null,
-    success:      function(data, accept){accept(null, true)},
-    fail:         function(data, message, critical, accept){accept(null, false)}
+    success: function(data, accept){
+      accept(null, true);
+    },
+    fail: function(error, data, accept){
+      accept(null, false);
+    }
   };
 
   var auth = xtend(defaults, options);
 
-  auth.userProperty = auth.passport._userProperty || 'user';
-
-  if (!auth.cookieParser) {
-    throw new Error('cookieParser is required use connect.cookieParser or express.cookieParser');
-  }
-
   return function(data, accept){
-    data.cookie = parseCookie(auth, data.headers.cookie || '');
-    data.sessionID = data.query.session_id || data.cookie[auth.key] || '';
-    data[auth.userProperty] = {
-      logged_in: false
-    };
+    var token, error;
 
-    if(data.xdomain && !data.sessionID)
-      return auth.fail(data, 'Can not read cookies from CORS-Requests. See CORS-Workaround in the readme.', false, accept);
+    if (data.headers && data.headers.authorization) {
+      var parts = data.headers.authorization.split(' ');
+      if (parts.length == 2) {
+        var scheme = parts[0],
+          credentials = parts[1];
 
-    auth.store.get(data.sessionID, function(err, session){
-      if(err)
-        return auth.fail(data, 'Error in session store:\n' + err.message, true, accept);
-      if(!session)
-        return auth.fail(data, 'No session found', false, accept);
-      if(!session[auth.passport._key])
-        return auth.fail(data, 'Passport was not initialized', true, accept);
-      
-      var userKey = session[auth.passport._key][auth.userProperty];
+        if (/^Bearer$/i.test(scheme)) {
+          token = credentials;
+        }
+      } else {
+        error = new UnauthorizedError('credentials_bad_format', {
+          message: 'Format is Authorization: Bearer [token]'
+        });
+        return auth.fail(error, data, accept);
+      }
+    }
 
-      if(!userKey)
-        return auth.fail(data, 'User not authorized through passport. (User Property not found)', false, accept);
+    if (data.query.token) {
+      token = data.query.token;
+    }
 
-      auth.passport.deserializeUser(userKey, function(err, user) {
-        if (err)
-          return auth.fail(data, err, true, accept);
-        if (!user)
-          return auth.fail(data, "User not found", false, accept);
-        data[auth.userProperty] = user;
-        data[auth.userProperty].logged_in = true;
-        auth.success(data, accept);
+    if (!token) {
+      error = new UnauthorizedError('credentials_required', {
+        message: 'No Authorization header was found'
       });
+      return auth.fail(error, data, accept);
+    }
 
+    jwt.verify(token, options.secret, options, function(err, decoded) {
+
+      if (err) {
+        error = new UnauthorizedError('invalid_token', err);
+        return auth.fail(error, data, accept);
+      }
+
+      data.user = decoded;
+      data.logged_in = true;
+
+      auth.success(data, accept);
     });
   };
 }