garyvv / node-sharp

app/catering_permissions.js

const Redis = require('./libraries/redis')
const Constant = require('./libraries/constant')
const ApiError = require('./util/api_error')
const _ = require('underscore')
const ServiceAudit = require('./services/catering/audit')
const ServiceStore = require('./services/catering/store')

module.exports = function (permission) {

	return async function (ctx, next) {

		async function checkToken() {
			let token = (typeof (ctx.request.headers.token) == 'undefined' || !ctx.request.headers.token) ?
				ctx.cookies.get('token') : ctx.request.headers.token
			let uid = (typeof (ctx.request.headers.uid) == 'undefined' || !ctx.request.headers.uid) ?
				ctx.cookies.get('uid') : ctx.request.headers.uid

			if (!token || !uid) {
				console.log('token: ' + token)

console.log looks like debug code. Are you sure you do not want to remove it?

				console.log('uid: ' + uid)
				throw new ApiError('auth.error', 'token missing')
			}

			sessionKey = Constant.CATERING_SESSION + token

The variable sessionKey seems to be never declared. Assigning variables without defining them first makes them global. If this was intended, consider making it explicit like using window.sessionKey.

			session = await Redis.get(sessionKey)

The variable session seems to be never declared. Assigning variables without defining them first makes them global. If this was intended, consider making it explicit like using window.session.

			session = JSON.parse(session)
			if (!session) {
				throw new ApiError('auth.error', 'token error')
			}

			if (session.uid == uid) {
				ctx.uid = uid
				return true
			} else {

else is not necessary here since all if branches return, consider removing it to reduce nesting and make code more readable.

				throw new ApiError('auth.error', 'no permission')
			}
			
		}

		async function checkUser() {
			await checkToken()
			await next()
		}

		async function checkAudit() {
			await checkToken()
			await isAudit()
			await next()
		}

		async function checkStore() {
			await checkToken()
			await ownerStore()
			await next()
		}

		async function isAudit() {
			let check = await ServiceAudit.getAudit(ctx.uid)
			if (_.isEmpty(check)) throw new ApiError('auth.error', 'no permission audit')

Curly braces around statements make for more readable code and help prevent bugs when you add further statements.

			return true
		}

		async function ownerStore() {
			let storeId = ctx.params.storeId
			let check = await ServiceStore.getStore(storeId)
			if (_.isEmpty(check)) throw new ApiError('auth.error', 'no permission store')

Curly braces around statements make for more readable code and help prevent bugs when you add further statements.

			if (check.seller_id != ctx.uid) throw new ApiError('auth.notPermission')

Curly braces around statements make for more readable code and help prevent bugs when you add further statements.

			return true
		}

		// 检查header
		if (!_.has(ctx.request.headers, 'store-id')) {
			throw new ApiError('validate.error', 'store-id')
		}
		if (!_.has(ctx.request.headers, 'mina-source')) {
			throw new ApiError('validate.error', 'mina-source')
		}

		// guest
		if (permission === 'guest') {
			await next()
		} else if (permission === 'user') {

There is no return statement in this branch, but you do return something in other branches. Did you maybe miss it? If you do not want to return anything, consider adding return undefined; explicitly.

			return await checkUser()
		} else if (permission === 'audit') {
			return await checkAudit()
		} else if (permission === 'store') {
			return await checkStore()
		} else {
			throw new ApiError('role.notExist')
		}

	}

}