126 lines
4.4 KiB
JavaScript
126 lines
4.4 KiB
JavaScript
const jwt = require('jsonwebtoken');
|
|
const { db, withRetry } = require('../database/db');
|
|
const { formatBoolean } = require('../utils/dbCompat');
|
|
const { getGalleryTokenFromRequest } = require('../utils/tokenUtils');
|
|
const logger = require('../utils/logger');
|
|
|
|
// Middleware to verify gallery access
|
|
async function verifyGalleryAccess(req, res, next) {
|
|
try {
|
|
const requestedSlug = req.params.slug || req.requestedSlug;
|
|
const token = getGalleryTokenFromRequest(req, requestedSlug);
|
|
let event;
|
|
|
|
if (!token) {
|
|
if (!requestedSlug) {
|
|
return res.status(401).json({ error: 'No token provided' });
|
|
}
|
|
|
|
event = await withRetry(async () => {
|
|
return await db('events')
|
|
.where({
|
|
slug: requestedSlug,
|
|
is_active: formatBoolean(true),
|
|
is_archived: formatBoolean(false)
|
|
})
|
|
.select('*')
|
|
.first();
|
|
});
|
|
|
|
if (!event) {
|
|
return res.status(404).json({ error: 'Gallery not found or expired' });
|
|
}
|
|
|
|
const requiresPassword = !(event.require_password === false || event.require_password === 0 || event.require_password === '0');
|
|
if (!requiresPassword) {
|
|
req.event = event;
|
|
req.sessionID = `gallery_public_${event.id}_${Date.now()}`;
|
|
req.clientInfo = {
|
|
ip: req.ip || req.connection.remoteAddress || 'unknown',
|
|
userAgent: req.get('User-Agent') || 'unknown',
|
|
fingerprint: `${req.ip}-${req.get('User-Agent')}`.substring(0, 32),
|
|
timestamp: Date.now()
|
|
};
|
|
return next();
|
|
}
|
|
|
|
return res.status(401).json({ error: 'No token provided' });
|
|
}
|
|
|
|
// Try to verify with issuer first, fallback to no issuer for backward compatibility
|
|
let decoded;
|
|
try {
|
|
decoded = jwt.verify(token, process.env.JWT_SECRET, {
|
|
issuer: 'picpeak-auth'
|
|
});
|
|
} catch (error) {
|
|
// If verification fails with issuer, try without issuer (backward compatibility)
|
|
if (error.name === 'JsonWebTokenError' && error.message.includes('jwt issuer invalid')) {
|
|
decoded = jwt.verify(token, process.env.JWT_SECRET);
|
|
} else {
|
|
throw error;
|
|
}
|
|
}
|
|
logger.debug('[verifyGalleryAccess] Token decoded successfully', { eventId: decoded.eventId, slug: requestedSlug });
|
|
|
|
// If we have a slug in the URL params or from pre-middleware, verify it matches
|
|
if (requestedSlug) {
|
|
// Verify by slug and ensure it matches the token's event
|
|
event = await withRetry(async () => {
|
|
return await db('events')
|
|
.where({
|
|
slug: requestedSlug,
|
|
is_active: formatBoolean(true),
|
|
is_archived: formatBoolean(false)
|
|
})
|
|
.select('*')
|
|
.first();
|
|
});
|
|
|
|
// Verify the token's eventId matches
|
|
if (event && event.id !== decoded.eventId) {
|
|
return res.status(403).json({ error: 'Token does not match requested gallery' });
|
|
}
|
|
} else {
|
|
// Fallback to using eventId from token
|
|
event = await withRetry(async () => {
|
|
return await db('events')
|
|
.where({
|
|
id: decoded.eventId,
|
|
is_active: formatBoolean(true),
|
|
is_archived: formatBoolean(false)
|
|
})
|
|
.select('*')
|
|
.first();
|
|
});
|
|
}
|
|
|
|
if (!event) {
|
|
logger.warn('[verifyGalleryAccess] Event not found for slug', { slug: requestedSlug || 'no-slug', tokenEventId: decoded.eventId });
|
|
return res.status(404).json({ error: 'Gallery not found or expired' });
|
|
}
|
|
|
|
logger.debug('[verifyGalleryAccess] Event located', { eventId: event.id, slug: event.slug });
|
|
req.event = event;
|
|
req.sessionID = decoded.sessionId || `gallery_${event.id}_${Date.now()}`;
|
|
|
|
// Create client info for logging (similar to secureImageMiddleware but simpler)
|
|
req.clientInfo = {
|
|
ip: req.ip || req.connection.remoteAddress || 'unknown',
|
|
userAgent: req.get('User-Agent') || 'unknown',
|
|
fingerprint: `${req.ip}-${req.get('User-Agent')}`.substring(0, 32), // Limit to 32 chars for DB column
|
|
timestamp: Date.now()
|
|
};
|
|
|
|
logger.debug('[verifyGalleryAccess] Access granted', { eventId: event.id, slug: event.slug });
|
|
next();
|
|
} catch (error) {
|
|
logger.error('Error verifying gallery access', { error: error.message, stack: error.stack });
|
|
res.status(401).json({ error: 'Invalid token' });
|
|
}
|
|
}
|
|
|
|
module.exports = {
|
|
verifyGalleryAccess
|
|
};
|