garyvv / node-sharp

app/permissions.js

const Redis = require('./libraries/redis')
const Constant = require('./libraries/constant')
const ApiError = require('./util/api_error')
module.exports = function (permission) {

	return async function (ctx, next) {

		async function checkToken() {
			let token = (typeof (ctx.request.headers.token) == 'undefined' || !ctx.request.headers.token) ?
				ctx.cookies.get('token') : ctx.request.headers.token
			let uid = (typeof (ctx.request.headers.uid) == 'undefined' || !ctx.request.headers.uid) ?
				ctx.cookies.get('uid') : ctx.request.headers.uid

			if (!token || !uid) {
				console.log('token: ' + token)
				console.log('uid: ' + uid)
				throw new ApiError('auth.error', 'token missing')
			}

			sessionKey = Constant.WECHAT_SESSION + token

The variable sessionKey seems to be never declared. Assigning variables without defining them first makes them global. If this was intended, consider making it explicit like using window.sessionKey.

			session = await Redis.get(sessionKey)

The variable session seems to be never declared. Assigning variables without defining them first makes them global. If this was intended, consider making it explicit like using window.session.

			session = JSON.parse(session)
			if (!session) {
				throw new ApiError('auth.error', 'token error')
			}

			if (session.uid == uid) {
				ctx.uid = uid
				return true
			} else {
				throw new ApiError('auth.error', 'no permission')
			}
			
		}

		async function checkUser() {
			await checkToken()
			await next()
		}

		// guest
		if (permission === 'guest') {
			await next()
		} else if (permission === 'user') {
			return await checkUser()
		} else {
			throw new ApiError('role.notExist')
		}

	}

}