diff --git a/app/controllers/forms.server.controller.js b/app/controllers/forms.server.controller.js index 129be700..17272194 100644 --- a/app/controllers/forms.server.controller.js +++ b/app/controllers/forms.server.controller.js @@ -124,17 +124,18 @@ exports.read = function(req, res) { if(!req.user || (req.form.admin.id !== req.user.id) ){ readForRender(req, res); } else { - var newForm = req.form.toJSON(); - - if (req.userId) { - if(req.form.admin._id+'' === req.userId+''){ - return res.json(newForm); - } + if(!req.form){ return res.status(404).send({ message: 'Form Does Not Exist' }); } + var newForm = req.form.toJSON(); + + if(newForm.admin._id === req.user._id){ + return res.json(newForm); + } + newForm = helpers.removeSensitiveModelData('private_form', newForm); return res.json(newForm); } diff --git a/app/controllers/users/users.authorization.server.controller.js b/app/controllers/users/users.authorization.server.controller.js index 1efbac64..ad7a78df 100755 --- a/app/controllers/users/users.authorization.server.controller.js +++ b/app/controllers/users/users.authorization.server.controller.js @@ -3,37 +3,7 @@ /** * Module dependencies. */ -var _ = require('lodash'), - mongoose = require('mongoose'), - User = mongoose.model('User'), - auth = require('../../../config/passport_helpers'); - -/** - * User middleware - */ -exports.userByID = function (req, res, next, id) { - if (!mongoose.Types.ObjectId.isValid(id)) { - return res.status(400).send({ - message: 'User is invalid' - }); - } - - User.findOne({ - _id: id - }).exec(function (err, user) { - if (err) { - return next(err); - } else if (!user) { - return res.status(404).send({ - message: 'User does not exist' - }); - } - - req.profile = user; - next(); - }); -}; - +var auth = require('../../../config/passport_helpers'); /** * Require login routing middleware */ @@ -46,22 +16,3 @@ exports.requiresLogin = function(req, res, next) { return next(); } }; - -/** - * User authorizations routing middleware - */ -exports.hasAuthorization = function(roles) { - var _this = this; - - return function(req, res, next) { - auth.isAuthenticatedOrApiKey(req, res, function() { - if (_.intersection(req.user.roles, roles).length) { - return next(); - } else { - return res.status(403).send({ - message: 'User is not authorized' - }); - } - }); - }; -}; diff --git a/app/routes/users.server.routes.js b/app/routes/users.server.routes.js index 86306033..89fbcd0e 100755 --- a/app/routes/users.server.routes.js +++ b/app/routes/users.server.routes.js @@ -33,7 +33,4 @@ module.exports = function(app) { app.route('/auth/signout').get(users.signout); app.route('/auth/genkey').get(users.requiresLogin, users.generateAPIKey); - - // Finish by binding the user middleware - app.param('userId', users.userByID); }; diff --git a/app/tests/form.server.routes.test.js b/app/tests/form.server.routes.test.js index 3de6057d..1ed05b06 100644 --- a/app/tests/form.server.routes.test.js +++ b/app/tests/form.server.routes.test.js @@ -278,7 +278,7 @@ describe('Form Routes Unit tests', function() { }); }); - it('should be able to save new form while logged in', function(done){ + it(' > should be able to save new form while logged in', function(done){ // Save a new Form authenticatedSession.post('/forms') .send({form: myForm}) diff --git a/config/express.js b/config/express.js index 7637bf4f..767e0bec 100755 --- a/config/express.js +++ b/config/express.js @@ -148,8 +148,6 @@ module.exports = function(db) { // reassign url req.url = subdomainPath; - req.userId = user._id; - // Q.E.D. return next(); });