From 9bf37c0f0be0ec279d837432fc51a8f6a9846eb7 Mon Sep 17 00:00:00 2001 From: Romina Suarez Date: Wed, 14 Feb 2018 19:16:49 -0300 Subject: [PATCH 1/3] Add routes to ignore when authentication fails --- .../auth/authentication-interceptor.config.js | 31 ++++++++++--------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/app/common/auth/authentication-interceptor.config.js b/app/common/auth/authentication-interceptor.config.js index 04f16fc09e..9b3e219a16 100644 --- a/app/common/auth/authentication-interceptor.config.js +++ b/app/common/auth/authentication-interceptor.config.js @@ -85,16 +85,12 @@ function AuthInterceptor($rootScope, $injector, $q, CONST, Session, _) { config.ignorable = true; } - if (config.url.indexOf('oauth/token') !== -1) { - config.ignorable = true; - } - - if (config.url.indexOf(CONST.API_URL) === -1) { deferred.resolve(config); return deferred.promise; } + config.ignorable = shouldIgnoreAuthError(config.url); var accessToken = Session.getSessionDataEntry('accessToken'); var accessTokenExpires = Session.getSessionDataEntry('accessTokenExpires'); var now = Math.floor(Date.now() / 1000); @@ -106,20 +102,12 @@ function AuthInterceptor($rootScope, $injector, $q, CONST, Session, _) { config.headers.Authorization = 'Bearer ' + accessToken; } - // else { - // // We are going to attempt to send the request without - // // any access token in it. - // // If the operation fails because authentication/ - // // authorization is needed, we will handle in - // // responseError() below - // } deferred.resolve(config); return deferred.promise; } function responseError(rejection) { var deferred = $q.defer(); - // When a request is rejected there are // a few possible reasons. If its a 401 // either our token expired, or we didn't have one. @@ -165,10 +153,25 @@ function AuthInterceptor($rootScope, $injector, $q, CONST, Session, _) { $rootScope.$broadcast('event:forbidden'); } deferred.reject(rejection); - // For anything else, just forward the rejection + // For anything else, just forward the rejection } else { deferred.reject(rejection); } return deferred.promise; } + + /** + * Returns true if url is ignorable, false if not + * @param requestUrl + */ + function shouldIgnoreAuthError(requestUrl) { + var i = 0; + var matchers = ['/oauth/token(/|$)', '/users(/|$)([0-9]+|$)', '/roles(/|$)']; + var isIgnorable = false; + while (isIgnorable === false && i < matchers.length) { + isIgnorable = !!requestUrl.match(matchers[i]); + i++; + } + return isIgnorable; + } } From 9efc946ad11115c2df6108dcd2209b4c271bf6e0 Mon Sep 17 00:00:00 2001 From: Romina Suarez Date: Wed, 14 Feb 2018 19:35:09 -0300 Subject: [PATCH 2/3] fix-permissions interceptor : check isIgnorable before the ignore403 check so it can be overriden --- app/common/auth/authentication-interceptor.config.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/common/auth/authentication-interceptor.config.js b/app/common/auth/authentication-interceptor.config.js index 9b3e219a16..750264a217 100644 --- a/app/common/auth/authentication-interceptor.config.js +++ b/app/common/auth/authentication-interceptor.config.js @@ -80,6 +80,8 @@ function AuthInterceptor($rootScope, $injector, $q, CONST, Session, _) { function request(config) { var deferred = $q.defer(); + config.ignorable = shouldIgnoreAuthError(config.url); + if (_.has(config, 'params') && config.params.ignore403) { delete config.params.ignore403; config.ignorable = true; @@ -90,7 +92,6 @@ function AuthInterceptor($rootScope, $injector, $q, CONST, Session, _) { return deferred.promise; } - config.ignorable = shouldIgnoreAuthError(config.url); var accessToken = Session.getSessionDataEntry('accessToken'); var accessTokenExpires = Session.getSessionDataEntry('accessTokenExpires'); var now = Math.floor(Date.now() / 1000); From 753260503fbd4d720660d08b213d5bc702177b62 Mon Sep 17 00:00:00 2001 From: Romina Suarez Date: Wed, 14 Feb 2018 19:37:59 -0300 Subject: [PATCH 3/3] fix-permissions interceptor : check isIgnorable before the ignore403 check so it can be overriden --- .../auth/authentication-interceptor.config.js | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/app/common/auth/authentication-interceptor.config.js b/app/common/auth/authentication-interceptor.config.js index 750264a217..742b10415e 100644 --- a/app/common/auth/authentication-interceptor.config.js +++ b/app/common/auth/authentication-interceptor.config.js @@ -80,12 +80,7 @@ function AuthInterceptor($rootScope, $injector, $q, CONST, Session, _) { function request(config) { var deferred = $q.defer(); - config.ignorable = shouldIgnoreAuthError(config.url); - - if (_.has(config, 'params') && config.params.ignore403) { - delete config.params.ignore403; - config.ignorable = true; - } + config.ignorable = shouldIgnoreAuthError(config); if (config.url.indexOf(CONST.API_URL) === -1) { deferred.resolve(config); @@ -163,14 +158,18 @@ function AuthInterceptor($rootScope, $injector, $q, CONST, Session, _) { /** * Returns true if url is ignorable, false if not - * @param requestUrl + * @param config */ - function shouldIgnoreAuthError(requestUrl) { + function shouldIgnoreAuthError(config) { + var isIgnorable = false; + if (_.has(config, 'params') && config.params.ignore403) { + delete config.params.ignore403; + isIgnorable = true; + } var i = 0; var matchers = ['/oauth/token(/|$)', '/users(/|$)([0-9]+|$)', '/roles(/|$)']; - var isIgnorable = false; while (isIgnorable === false && i < matchers.length) { - isIgnorable = !!requestUrl.match(matchers[i]); + isIgnorable = !!config.url.match(matchers[i]); i++; } return isIgnorable;