garyvv / node-sharp

app/permissions.js

const Redis = require('./libraries/redis')
const Constant = require('./libraries/constant')
const ApiError = require('./util/api_error')
module.exports = function (permission) {

	return async function (ctx, next) {

		async function checkToken() {
			let token = (typeof (ctx.request.headers.token) == 'undefined' || !ctx.request.headers.token) ?
				ctx.cookies.get('token') : ctx.request.headers.token
			let uid = (typeof (ctx.request.headers.uid) == 'undefined' || !ctx.request.headers.uid) ?
				ctx.cookies.get('uid') : ctx.request.headers.uid

			if (!token || !uid) {
				console.log('token: ' + token)

console.log looks like debug code. Are you sure you do not want to remove it?

				console.log('uid: ' + uid)
				throw new ApiError('auth.error', 'token missing')
			}

			sessionKey = Constant.WECHAT_SESSION + token

The variable sessionKey seems to be never declared. Assigning variables without defining them first makes them global. If this was intended, consider making it explicit like using window.sessionKey.

			session = await Redis.get(sessionKey)

The variable session seems to be never declared. Assigning variables without defining them first makes them global. If this was intended, consider making it explicit like using window.session.

			session = JSON.parse(session)
			if (!session) {
				throw new ApiError('auth.error', 'token error')
			}

			if (session.uid == uid) {
				ctx.uid = uid
				return true
			} else {

else is not necessary here since all if branches return, consider removing it to reduce nesting and make code more readable.

				throw new ApiError('auth.error', 'no permission')
			}
			
		}

		async function checkUser() {
			await checkToken()
			await next()
		}

		// guest
		if (permission === 'guest') {
			await next()
		} else if (permission === 'user') {

There is no return statement in this branch, but you do return something in other branches. Did you maybe miss it? If you do not want to return anything, consider adding return undefined; explicitly.

			return await checkUser()
		} else {
			throw new ApiError('role.notExist')
		}

	}

}