deployd/deployd — Issue #12: Authentication Override
Author: ritch
Created: 2011-12-31 20:35:54+00:00
State: open
Labels: 0.3.x, feature, security

Some users will need to implement deployd against an existing user management system. This requires a simple mechanism to override the existing authentication.

Sessions are currently automatically created and stored. These pass through the current user to the model. The model knows how to authenticate whether a user can create, read, update, or delete itself.

The only override needed should be:

// existing login method
app.post('/users/login', function(req, res) {
user('login', req.body, req, {
send: function(u) {
if(!u.errors) {
u.auth = req.sessionID;
req.session.user = u;
} else {
u.errors = [{"message":"The Username or Password were incorrect","type":"Login"}];
}
res.send(u);
}
});
});

// overriden login method
app.post('/users/login', function(req, res) {
var auth = req.param('auth')
, email = req.param('email')
;

fb.authorize(auth, email, function (err, authed) {
User
.find({email: authed && email})
.notify(function (user) {
if(user.email) {
req.session = user;
}
res.send(json);
})
.fetch()
;
})
});