added oauth refresh token support

Co-authored-by: timvisee <tim@visee.me>

server/middleware/auth.js

@@ -70,6 +70,10 @@ module.exports = {
       const token = authHeader.split(' ')[1];
       req.user = await fxa.verify(token);
     }
-    return next();
+    if (req.user) {
+      next();
+    } else {
+      res.sendStatus(401);
+    }
   }
 };

server/routes/filelist.js

@@ -13,9 +13,6 @@ function id(user, kid) {
 
 module.exports = {
   async get(req, res) {
-    if (!req.user) {
-      return res.sendStatus(401);
-    }
     const kid = req.params.id;
     try {
       const fileId = id(req.user, kid);
@@ -32,9 +29,6 @@ module.exports = {
   },
 
   async post(req, res) {
-    if (!req.user) {
-      return res.sendStatus(401);
-    }
     const kid = req.params.id;
     try {
       const limiter = new Limiter(1024 * 1024 * 10);

server/routes/ws.js

@@ -41,6 +41,14 @@ module.exports = function(ws, req) {
         ? config.max_downloads
         : config.anon_max_downloads;
 
+      if (config.fxa_required && !user) {
+        ws.send(
+          JSON.stringify({
+            error: 401
+          })
+        );
+        return ws.close();
+      }
       if (
         !metadata ||
         !auth ||