Merge pull request #79 from versx/token

Add device token middleware

Author: versx

src/config.example.json

@@ -2,6 +2,7 @@
     "title": "Device Config Manager",
     "interface": "0.0.0.0",
     "port": 9991,
+    "tokens": ["Replace with GC/Kevin/AI token"],
     "locale": "en",
     "style": "dark",
     "timezone": "America/Denver",

src/middleware/auth-header.js

@@ -0,0 +1,16 @@
+'use strict';
+
+const config = require('../config.json');
+
+module.exports = (req, res, next) => {
+    const authHeader = req.headers['authorization'];
+    if (!authHeader) {
+        return res.sendStatus(403);
+    }
+    const bearer = authHeader.split(' ')[1];
+    if (config.tokens.length > 0 && !config.tokens.includes((bearer || '').toLowerCase())) {
+        return res.sendStatus(403);
+    }
+    //return true;
+    return next();
+};

src/routes/api.js

@@ -11,6 +11,7 @@ const screenshotsDir = path.resolve(__dirname, '../../screenshots');
 const upload = multer({ dest: screenshotsDir });
 
 const config = require('../config.json');
+const AuthTokenMiddleware = require('../middleware/auth-header.js');
 const Account = require('../models/account.js');
 const Config = require('../models/config.js');
 const Device = require('../models/device.js');
@@ -307,7 +308,7 @@ router.post('/device/edit/:uuid', async (req, res) => {
 });
 
 // Kevin screenshot support
-router.post('/device/:uuid/screen', upload.single('file'), (req, res) => {
+router.post('/device/:uuid/screen', AuthTokenMiddleware, upload.single('file'), (req, res) => {
     const uuid = req.params.uuid;
     const fileName = uuid + '.png';
     const tempPath = req.file.path;
@@ -344,7 +345,7 @@ router.post('/device/:uuid/screen', upload.single('file'), (req, res) => {
     }
 });
 
-router.post('/device/screen/:uuid', (req, res) => {
+router.post('/device/screen/:uuid', AuthTokenMiddleware, (req, res) => {
     const uuid = req.params.uuid;
     logger('dcm').info(`Received screen ${uuid}`);
     const data = Buffer.from(req.body.body, 'base64');
@@ -399,7 +400,7 @@ router.get('/configs', async (req, res) => {
     }
 });
 
-router.post('/config', async (req, res) => {
+router.post('/config', AuthTokenMiddleware, async (req, res) => {
     const { uuid, ios_version, ipa_version, model, webserver_port } = req.body;
     let device = await Device.getByName(uuid);
     let noConfig = false;
@@ -672,7 +673,7 @@ router.get('/logs/:uuid', async (req, res) => {
     });
 });
 
-router.post('/log/new', async (req, res) => {
+router.post('/log/new', AuthTokenMiddleware, async (req, res) => {
     if (!config.logging.enabled) {
         // Logs are disabled
         res.send('OK');