mirror of https://github.com/ghostfolio/ghostfolio
2 changed files with 40 additions and 30 deletions
@ -0,0 +1,37 @@ |
|||
import { hasPermission, permissions } from '@ghostfolio/common/permissions'; |
|||
|
|||
import { Injectable, NestMiddleware } from '@nestjs/common'; |
|||
import { NextFunction, Request, Response } from 'express'; |
|||
import { getReasonPhrase, StatusCodes } from 'http-status-codes'; |
|||
import passport from 'passport'; |
|||
|
|||
@Injectable() |
|||
export class BullBoardAuthMiddleware implements NestMiddleware { |
|||
public use(req: Request, res: Response, next: NextFunction) { |
|||
const token = req.headers.cookie |
|||
?.split(';') |
|||
.map((c) => c.trim()) |
|||
.find((c) => c.startsWith('bull_board_token=')) |
|||
?.split('=')[1]; |
|||
|
|||
if (token) { |
|||
req.headers.authorization = `Bearer ${token}`; |
|||
} |
|||
|
|||
passport.authenticate('jwt', { session: false }, (error, user) => { |
|||
if ( |
|||
error || |
|||
!user || |
|||
!hasPermission(user.permissions, permissions.accessAdminControl) |
|||
) { |
|||
res |
|||
.status(StatusCodes.FORBIDDEN) |
|||
.json({ message: getReasonPhrase(StatusCodes.FORBIDDEN) }); |
|||
|
|||
return; |
|||
} |
|||
|
|||
next(); |
|||
})(req, res, next); |
|||
} |
|||
} |
|||
Loading…
Reference in new issue