refactored server

server/middleware/auth.js

@@ -0,0 +1,38 @@
+const crypto = require('crypto');
+const storage = require('../storage');
+
+module.exports = async function(req, res, next) {
+  const id = req.params.id;
+  if (id && req.header('Authorization')) {
+    try {
+      const auth = req.header('Authorization').split(' ')[1];
+      const meta = await storage.metadata(id);
+      if (!meta) {
+        return res.sendStatus(404);
+      }
+      const hmac = crypto.createHmac(
+        'sha256',
+        Buffer.from(meta.auth, 'base64')
+      );
+      hmac.update(Buffer.from(meta.nonce, 'base64'));
+      const verifyHash = hmac.digest();
+      if (verifyHash.equals(Buffer.from(auth, 'base64'))) {
+        req.nonce = crypto.randomBytes(16).toString('base64');
+        storage.setField(id, 'nonce', req.nonce);
+        res.set('WWW-Authenticate', `send-v1 ${req.nonce}`);
+        req.authorized = true;
+        req.meta = meta;
+      } else {
+        res.set('WWW-Authenticate', `send-v1 ${meta.nonce}`);
+        req.authorized = false;
+      }
+    } catch (e) {
+      req.authorized = false;
+    }
+  }
+  if (req.authorized) {
+    next();
+  } else {
+    res.sendStatus(401);
+  }
+};

server/middleware/language.js

@@ -0,0 +1,40 @@
+const { availableLanguages } = require('../../package.json');
+const config = require('../config');
+const fs = require('fs');
+const path = require('path');
+const { negotiateLanguages } = require('fluent-langneg');
+const langData = require('cldr-core/supplemental/likelySubtags.json');
+const acceptLanguages = /(([a-zA-Z]+(-[a-zA-Z0-9]+){0,2})|\*)(;q=[0-1](\.[0-9]+)?)?/g;
+
+function allLangs() {
+  return fs.readdirSync(
+    path.join(__dirname, '..', '..', 'dist', 'public', 'locales')
+  );
+}
+
+const languages = config.l10n_dev ? allLangs() : availableLanguages;
+
+module.exports = function(req, res, next) {
+  const header = req.headers['accept-language'] || 'en-US';
+  if (header.length > 255) {
+    req.language = 'en-US';
+    return next();
+  }
+  const langs = header.replace(/\s/g, '').match(acceptLanguages);
+  const preferred = langs
+    .map(l => {
+      const parts = l.split(';');
+      return {
+        locale: parts[0],
+        q: parts[1] ? parseFloat(parts[1].split('=')[1]) : 1
+      };
+    })
+    .sort((a, b) => b.q - a.q)
+    .map(x => x.locale);
+  req.language = negotiateLanguages(preferred, languages, {
+    strategy: 'lookup',
+    likelySubtags: langData.supplemental.likelySubtags,
+    defaultLocale: 'en-US'
+  })[0];
+  next();
+};

server/middleware/owner.js

@@ -0,0 +1,22 @@
+const storage = require('../storage');
+
+module.exports = async function(req, res, next) {
+  const id = req.params.id;
+  const ownerToken = req.body.owner_token;
+  if (id && ownerToken) {
+    try {
+      req.meta = await storage.metadata(id);
+      if (!req.meta) {
+        return res.sendStatus(404);
+      }
+      req.authorized = req.meta.owner === ownerToken;
+    } catch (e) {
+      req.authorized = false;
+    }
+  }
+  if (req.authorized) {
+    next();
+  } else {
+    res.sendStatus(401);
+  }
+};