salesforce / refocus / 7607

89%

push

travis-ci

update jwtUtils token verification for generators and collectors (#880)

* update jwtUtils token verification for generators and collectors

utils/jwtUtil.js
- add new "IsGenerator" header
- minor formatting and var name cleanup
- do user check for user/generator/collector token types
- unnest the nested "try to verify me as a person first and if that fails then try to verify me as a collector and so on..." -- identify the type of user but fall back to trying to verify as a person if the type is not available (e.g. from an old token generated before we were adding that information to the token payload)
- when verifying a collector token, the token name must match a collector name and the user must exist
- when verifying a generator token, the token name must match a generator name and the user must exist
- simplify error message when token is invalid to just "Forbidden" -- we shouldn't be giving a potential attacker more details about why it was forbidden

api/v1/controllers/collectors.js
- update the patch algorithm when patching restricted fields to just use the "IsCollector" header which is set by the authentication process
- collector tokens will have collector name as the token name and user name as user name
- create collector tokens with { IsCollector: true }
- generator tokens will have generator name as the token name and user name as user name
- create generator tokens with { IsGenerator: true }

realtime/setupSocketIO.js
- minor cleanup and var name changes for clarification

tests/api/v1/collectors/heartbeat.js
- minor formatting and test name clarification only

tests/api/v1/collectors/patch.js
- create collector tokens with collector name, user name and { IsCollector: true }
- rewrite tests to expect "Forbidden" message
- minor formatting

tests/api/v1/collectors/start.js
- rewrite tests to expect "Forbidden" message

tests/enforceToken/createToken.js
- rewrite tests to expect "Forbidden" message

tests... (continued)

2322 of 2908 branches covered (79.85%)

6263 of 7035 relevant lines covered (89.03%)

370.64 hits per line