|
| 1 | +import { warn } from '../../logger.js'; |
1 | 2 | import { getConfig } from '../../modules/config.js'; |
2 | 3 | import { getBotOwnerIds } from '../../utils/permissions.js'; |
3 | | -import { warn } from '../../logger.js'; |
4 | 4 |
|
5 | 5 | /** |
6 | 6 | * Middleware: restrict to API-secret callers or bot-owner OAuth users. |
7 | 7 | */ |
8 | 8 | export function requireGlobalAdmin(forResource, req, res, next) { |
9 | | - console.error('[DEBUG] requireGlobalAdmin called'); |
10 | | - console.error('[DEBUG] arguments.length:', arguments.length); |
11 | | - console.error('[DEBUG] typeof forResource:', typeof forResource); |
12 | | - |
13 | 9 | // Support both requireGlobalAdmin(req, res, next) and requireGlobalAdmin('Resource', req, res, next) |
14 | 10 | if (arguments.length === 3) { |
15 | | - console.error('[DEBUG] 3-arg case: shifting parameters'); |
16 | 11 | // Called as requireGlobalAdmin(req, res, next) |
17 | 12 | // Parameters are shifted: forResource=req, req=res, res=next, next=undefined |
18 | | - next = res; // res parameter is actually the next function |
19 | | - res = req; // req parameter is actually the res object |
| 13 | + next = res; // res parameter is actually the next function |
| 14 | + res = req; // req parameter is actually the res object |
20 | 15 | req = forResource; // forResource is the actual req object |
21 | 16 | forResource = 'Global admin access'; |
22 | 17 | } else { |
23 | 18 | forResource = forResource || 'Global admin access'; |
24 | 19 | } |
25 | 20 |
|
26 | | - console.error('[DEBUG] After shift - authMethod:', req.authMethod, 'userId:', req.user?.userId); |
27 | | - |
28 | 21 | if (req.authMethod === 'api-secret') { |
29 | | - console.error('[DEBUG] api-secret - calling next()'); |
30 | 22 | return next(); |
31 | 23 | } |
32 | 24 |
|
33 | 25 | if (req.authMethod === 'oauth') { |
34 | 26 | const config = getConfig(); |
35 | 27 | const botOwners = getBotOwnerIds(config); |
36 | | - console.error('[DEBUG] oauth - botOwners:', botOwners, 'userId:', req.user?.userId); |
37 | 28 | if (botOwners.includes(req.user?.userId)) { |
38 | | - console.error('[DEBUG] oauth owner - calling next()'); |
39 | 29 | return next(); |
40 | 30 | } |
41 | | - console.error('[DEBUG] oauth non-owner - returning 403'); |
42 | 31 | return res.status(403).json({ error: `${forResource} requires bot owner permissions` }); |
43 | 32 | } |
44 | 33 |
|
45 | | - console.error('[DEBUG] unknown authMethod - returning 401'); |
46 | 34 | warn('Unknown authMethod in global admin check', { |
47 | 35 | authMethod: req.authMethod, |
48 | 36 | path: req.path, |
|
0 commit comments