Make user CRUD route's protected behind auth

config/server.js

@@ -7,7 +7,7 @@ import session from 'koa-generic-session'
 import passport from 'koa-passport'
 
 import config from './config'
-import { errorMiddleware } from '../src/utils'
+import { errorMiddleware } from '../src/middleware'
 
 const app = new Koa()
 app.keys = [config.session]

src/controllers/users.js

@@ -2,10 +2,12 @@ import Router from 'koa-router'
 import User from '../models/users'
 import config from '../../config/config'
 import jwt from 'jsonwebtoken'
+import { ensureUser } from '../middleware/validators'
 
 const router = new Router({ prefix: '/users' })
 
 router.get('/',
+  ensureUser,
   async (ctx) => {
     const users = User.find({}, '-password -salt')
     ctx.body = users
@@ -13,6 +15,7 @@ router.get('/',
 )
 
 router.get('/:id',
+  ensureUser,
   async (ctx) => {
     const user = await User.findById(ctx.params.id, '-password -salt')
     if (!user) {
@@ -46,6 +49,7 @@ router.post('/',
 )
 
 router.put('/:id',
+  ensureUser,
   async (ctx) => {
     const user = await User.findById(ctx.params.id)
 
@@ -62,6 +66,7 @@ router.put('/:id',
 )
 
 router.delete('/:id',
+  ensureUser,
   async (ctx) => {
     const user = await User.findById(ctx.params.id)
 

src/utils/index.js

@@ -1,11 +0,0 @@
-export function errorMiddleware() {
-  return async (ctx, next) => {
-    try {
-      await next()
-    } catch (err) {
-      ctx.status = err.status || 500
-      ctx.body = err.message
-      ctx.app.emit('error', err, ctx)
-    }
-  }
-}

src/utils/users.js

@@ -1,29 +0,0 @@
-import User from '../models/users'
-import config from '../../config/config'
-import { verify } from 'jsonwebtoken'
-
-export async function ensureUser(ctx, next) {
-  const { token } = ctx.query
-
-  if (!token) {
-    ctx.throw(401)
-  }
-
-  let decoded = null
-  try {
-    decoded = verify(token, config.tokenSecret)
-  } catch (err) {
-    ctx.throw(401)
-  }
-
-  try {
-    const user = await User.findById(decoded.id)
-    if (!user) {
-      ctx.throw(401)
-    }
-  } catch (err) {
-    ctx.throw(500)
-  }
-
-  return next()
-}