c84866dda7
- Fixed session invalidation for "locked" user - Currently Ghost API was returning 404 for users having status set to "locked". This lead the user to be stuck in Ghost-Admin with "Rousource Not Found" error message. - By returning 401 for non-"active" users it allows for the Ghost-Admin to redirect the user to "signin" screen where they would be instructed to reset their password - Fixed error message returned by session API - Instead of returning generic 'access' denied message when error happens during `User.check` we want to return more specific error thrown inside of the method, e.g.: 'accountLocked' or 'accountSuspended' - Fixed messaging for 'accountLocked' i18n, which not corresponds to the actual UI available to the end user - Added automatic password reset email to locked users on sign-in - uses alternative email for required password reset so it's clear that this is a security related reset and not a user-requested reset - Backported the auto sending of required password reset email to v2 sign-in route - used by 3rd party clients where the email is necessary for users to know why login is failing Co-authored-by: Kevin Ansfield <kevin@lookingsideways.co.uk>
72 lines
2.7 KiB
JavaScript
72 lines
2.7 KiB
JavaScript
const _ = require('lodash');
|
|
const Promise = require('bluebird');
|
|
const models = require('../../models');
|
|
const errors = require('@tryghost/errors');
|
|
const {i18n} = require('../../lib/common');
|
|
|
|
module.exports = {
|
|
user: function (id) {
|
|
return models.User.findOne({id: id}, {withRelated: ['permissions', 'roles', 'roles.permissions']})
|
|
.then(function (foundUser) {
|
|
// CASE: {context: {user: id}} where the id is not in our database
|
|
if (!foundUser) {
|
|
return Promise.reject(new errors.NotFoundError({
|
|
message: i18n.t('errors.models.user.userNotFound')
|
|
}));
|
|
}
|
|
|
|
if (foundUser.get('status') !== 'active') {
|
|
return Promise.reject(new errors.UnauthorizedError());
|
|
}
|
|
|
|
const seenPerms = {};
|
|
|
|
const rolePerms = _.map(foundUser.related('roles').models, function (role) {
|
|
return role.related('permissions').models;
|
|
});
|
|
|
|
const allPerms = [];
|
|
const user = foundUser.toJSON();
|
|
|
|
rolePerms.push(foundUser.related('permissions').models);
|
|
|
|
_.each(rolePerms, function (rolePermGroup) {
|
|
_.each(rolePermGroup, function (perm) {
|
|
const key = perm.get('action_type') + '-' + perm.get('object_type') + '-' + perm.get('object_id');
|
|
|
|
// Only add perms once
|
|
if (seenPerms[key]) {
|
|
return;
|
|
}
|
|
|
|
allPerms.push(perm);
|
|
seenPerms[key] = true;
|
|
});
|
|
});
|
|
|
|
// @TODO fix this!
|
|
// Permissions is an array of models
|
|
// Roles is a JSON array
|
|
return {permissions: allPerms, roles: user.roles};
|
|
});
|
|
},
|
|
|
|
apiKey(id) {
|
|
return models.ApiKey.findOne({id}, {withRelated: ['role', 'role.permissions']})
|
|
.then((foundApiKey) => {
|
|
if (!foundApiKey) {
|
|
throw new errors.NotFoundError({
|
|
message: i18n.t('errors.models.api_key.apiKeyNotFound')
|
|
});
|
|
}
|
|
|
|
// api keys have a belongs_to relationship to a role and no individual permissions
|
|
// so there's no need for permission deduplication
|
|
const permissions = foundApiKey.related('role').related('permissions').models;
|
|
const roles = [foundApiKey.toJSON().role];
|
|
|
|
return {permissions, roles};
|
|
});
|
|
}
|
|
};
|