Updated RESTApi to have tokens also

server/apps/addtype.js

@@ -1,15 +1,29 @@
 path = require('path'),
 pathThumbnails = __dirname;
 db = require(pathThumbnails + '/../handlers/db.js');
+var usual = [];
+var settings = [];
 
 db.getCollectionNames(function(err, docs) {
-    for(var i = 0; i < docs.length; i++) {
-        addType(docs[i]);
+    /*for(var i = 0; i < docs.length; i++) {
+        if(docs[i].indexOf("_settings") > -1) {
+            settings.push(docs[0]);
+        } else {
+            usual.push(docs[0]);
         }
+        //addType(docs[i]);
+    }
+    for(var i = 0; i < usual.length; i++) {
+        if(settings.indexOf(usual + "_settings") < 0) {
+            console.log(usual);
+        }
+    }*/
 })
 
 function addType(name) {
-    db.collection(name).update({duration: {$exists: true},type:{$ne:"suggested"}}, {$set: { type: "video" }}, {multi: true}, function(err, doc) {
-        process.exit();
+    if(name.indexOf("_settings") > -1) {
+        db.collection(name).update({views: {$exists: true}}, {$set: { id: "config" }}, {multi: true}, function(err, doc) {
+            console.log(name);
         });
     }
+}

server/public/assets/admin/authenticated/js/main.js

@@ -205,6 +205,19 @@ $(document).on("click", "#get_token", function(e){
 	})
 });
 
+$(document).on("click", "#get_api_token", function(e){
+	e.preventDefault();
+	$.ajax({
+		type: "GET",
+		url: "/api/api_token",
+		success: function(response){
+			if(response != false){
+				$("#new_api_token").val(response.token);
+			}
+		}
+	})
+});
+
 $(document).on("click", ".approve_thumbnails", function(e){
 	e.preventDefault();
 	var channel = $(this).attr("data-channel");

server/public/layouts/admin/authenticated.handlebars

@@ -98,6 +98,15 @@
               <a href="#" id="remove_token" class="btn red waves-effect hide">REMOVE</a>
             </div>
         </div>
+
+        <div class="row">
+          <div class="input-field col s8 m10">
+            <input type="text" readonly id="new_api_token" />
+          </div>
+          <div class="col s2">
+            <a href="#" id="get_api_token" class="btn waves-effect purple">GET API</a>
+          </div>
+      </div>
       </div>
     </div>
     <div id="thumbnails" class="col s12">

server/routing/admin/api.js

@@ -5,6 +5,8 @@ var mongo_db_cred = require(path.join(__dirname, '../../config/mongo_config.js')
 var mongojs = require('mongojs');
 var db = mongojs(mongo_db_cred.config);
 var token_db = mongojs("tokens");
+var uniqid = require('uniqid');
+var crypto = require('crypto');
 
 router.use(function(req, res, next) {
     next(); // make sure we go to the next routes and don't stop here
@@ -164,6 +166,17 @@ router.route('/api/token').get(function(req, res){
    }
 });
 
+router.route('/api/api_token').get(function(req, res){
+   if(req.isAuthenticated()){
+      var id = crypto.createHash('sha256').update(uniqid()).digest('base64');
+      token_db.collection("api_token").insert({token: id}, function(err, docs){
+         res.json({token: id});
+      });
+   } else {
+      res.send(false);
+   }
+});
+
 router.route('/api/delete').post(function(req, res){
    if(req.isAuthenticated()){
       var list = req.body._id;

server/routing/client/api.js

@@ -3,6 +3,8 @@ var router = express.Router();
 var path = require('path');
 var mongojs = require('mongojs');
 var ObjectId = mongojs.ObjectId;
+var token_db = mongojs("tokens");
+
 var toShowChannel = {
     start: 1,
     end: 1,
@@ -120,6 +122,10 @@ router.route('/api/list/:channel_name/:video_id').delete(function(req, res) {
         res.status(400).send(JSON.stringify(error.formatting));
         return;
     }
+    var token = "";
+    if(req.body.hasOwnProperty("token")) {
+        token = req.body.token;
+    }
     try {
         var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
         var guid = Functions.hash_pass(req.get('User-Agent') + ip + req.headers["accept-language"]);
@@ -136,7 +142,13 @@ router.route('/api/list/:channel_name/:video_id').delete(function(req, res) {
         return;
     }
 
-    checkTimeout(guid, res, "DELETE", function() {
+    token_db.collection("api_token").find({token: token}, function(err, token_docs) {
+        var authorized = false;
+        if(token_docs.length == 1 && token_docs.token == token) {
+            authorized = true;
+        }
+
+        checkTimeout(guid, res, authorized, "DELETE", function() {
             validateLogin(adminpass, userpass, channel_name, "delete", res, function(exists) {
                 if(!exists) {
                     res.status(404).send(JSON.stringify(error.not_found.list));
@@ -156,13 +168,13 @@ router.route('/api/list/:channel_name/:video_id').delete(function(req, res) {
                             io.to(channel_name).emit("channel", {type:"deleted", value: video_id});
                             if(!dont_increment) {
                                 db.collection("frontpage_lists").update({_id: channel_name, count: {$gt: 0}}, {$inc: {count: -1}, $set:{accessed: Functions.get_time()}}, {upsert: true}, function(err, docs){
-                                updateTimeout(guid, res, "DELETE", function(err, docs) {
+                                    updateTimeout(guid, res, authorized, "DELETE", function(err, docs) {
                                         res.status(200).send(JSON.stringify(error.no_error));
                                         return;
                                     });
                                 });
                             } else {
-                            updateTimeout(guid, res, "DELETE", function(err, docs) {
+                                updateTimeout(guid, res, authorized, "DELETE", function(err, docs) {
                                     res.status(200).send(JSON.stringify(error.no_error));
                                     return;
                                 });
@@ -173,11 +185,13 @@ router.route('/api/list/:channel_name/:video_id').delete(function(req, res) {
             });
         });
     });
+});
 
 router.route('/api/conf/:channel_name').put(function(req, res) {
     res.header("Access-Control-Allow-Origin", "*");
     res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
     res.header({"Content-Type": "application/json"});
+
     if(!req.body.hasOwnProperty('adminpass') || !req.body.hasOwnProperty('userpass') ||
         !req.params.hasOwnProperty('channel_name') || !req.body.hasOwnProperty('vote') ||
         !req.body.hasOwnProperty('addsongs') || !req.body.hasOwnProperty('longsongs') ||
@@ -187,6 +201,10 @@ router.route('/api/conf/:channel_name').put(function(req, res) {
         res.status(400).send(JSON.stringify(error.formatting));
         return;
     }
+    var token = "";
+    if(req.body.hasOwnProperty("token")) {
+        token = req.body.token;
+    }
     try {
         var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
         var guid = Functions.hash_pass(req.get('User-Agent') + ip + req.headers["accept-language"]);
@@ -215,7 +233,13 @@ router.route('/api/conf/:channel_name').put(function(req, res) {
         res.status(400).send(JSON.stringify(error.formatting));
         return;
     }
-    checkTimeout(guid, res, "CONFIG", function() {
+
+    token_db.collection("api_token").find({token: token}, function(err, token_docs) {
+        var authorized = false;
+        if(token_docs.length == 1 && token_docs.token == token) {
+            authorized = true;
+        }
+        checkTimeout(guid, res, authorized, "CONFIG", function() {
             validateLogin(adminpass, userpass, channel_name, "config", res, function(exists, conf) {
                 if(!exists && conf.length == 0) {
                     res.status(404).send(JSON.stringify(error.not_found.list));
@@ -259,7 +283,7 @@ router.route('/api/conf/:channel_name').put(function(req, res) {
                         frontpage:frontpage, accessed: Functions.get_time()}
                     },
                     {upsert:true}, function(err, docs){
-                    updateTimeout(guid, res, "CONFIG", function(err, docs) {
+                        updateTimeout(guid, res, authorized, "CONFIG", function(err, docs) {
                             var to_return = error.no_error;
                             to_return.results = [obj];
                             res.status(200).send(JSON.stringify(to_return));
@@ -270,6 +294,7 @@ router.route('/api/conf/:channel_name').put(function(req, res) {
             });
         });
     });
+});
 
 router.route('/api/list/:channel_name/:video_id').put(function(req,res) {
     res.header("Access-Control-Allow-Origin", "*");
@@ -281,7 +306,10 @@ router.route('/api/list/:channel_name/:video_id').put(function(req,res) {
         res.status(400).send(JSON.stringify(error.formatting));
         return;
     }
-
+    var token = "";
+    if(req.body.hasOwnProperty("token")) {
+        token = req.body.token;
+    }
     try {
         var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
         var guid = Functions.hash_pass(req.get('User-Agent') + ip + req.headers["accept-language"]);
@@ -298,7 +326,13 @@ router.route('/api/list/:channel_name/:video_id').put(function(req,res) {
         return;
     }
 
-    checkTimeout(guid, res, "PUT", function() {
+    token_db.collection("api_token").find({token: token}, function(err, token_docs) {
+        var authorized = false;
+        if(token_docs.length == 1 && token_docs.token == token) {
+            authorized = true;
+        }
+
+        checkTimeout(guid, res, authorized, "PUT", function() {
             validateLogin(adminpass, userpass, channel_name, "vote", res, function(exists) {
                 if(!exists) {
                     res.status(404).send(JSON.stringify(error.not_found.list));
@@ -317,7 +351,7 @@ router.route('/api/list/:channel_name/:video_id').put(function(req,res) {
                         db.collection(channel_name).update({id: video_id}, {$inc:{votes:1}, $set:{added:Functions.get_time(), type: "video"}, $push :{guids: guid}}, function(err, success) {
                             io.to(channel_name).emit("channel", {type: "vote", value: video_id, time: Functions.get_time()});
                             List.getNextSong(channel_name, function() {
-                            updateTimeout(guid, res, "PUT", function(err, docs) {
+                                updateTimeout(guid, res, authorized, "PUT", function(err, docs) {
                                     var to_return = error.no_error;
                                     to_return.results = song;
                                     res.status(200).send(JSON.stringify(to_return));
@@ -330,6 +364,7 @@ router.route('/api/list/:channel_name/:video_id').put(function(req,res) {
             });
         });
     });
+});
 
 router.route('/api/list/:channel_name/__np__').post(function(req, res) {
     res.header("Access-Control-Allow-Origin", "*");
@@ -347,16 +382,25 @@ router.route('/api/list/:channel_name/__np__').post(function(req, res) {
     var channel_name = req.params.channel_name;
     req.body.userpass = req.body.userpass == "" ? "" : crypto.createHash('sha256').update(req.body.userpass, 'utf8').digest("hex");
     var userpass = req.body.userpass;
-
+    var token = "";
+    if(req.body.hasOwnProperty("token")) {
+        token = req.body.token;
+    }
+    console.log(token);
     if(typeof(userpass) != "string") {
         res.status(400).send(JSON.stringify(error.formatting));
         return;
     }
-
-    checkTimeout(guid, res, "POST", function() {
+    token_db.collection("api_token").find({token: token}, function(err, token_docs) {
+        var authorized = false;
+        if(token_docs.length == 1 && token_docs.token == token) {
+            authorized = true;
+        }
+        console.log(authorized);
+        checkTimeout(guid, res, authorized, "POST", function() {
             db.collection(channel_name).find({now_playing: true}, toShowChannel, function(err, list) {
                 if(list.length > 0) {
-                db.collection(channel_name + "_settings").find({views: {$exists: true}}, function(err, conf) {
+                    db.collection(channel_name + "_settings").find({ id: "config" }, function(err, conf) {
                         if(conf.length == 0) {
                             res.status(404).send(JSON.stringify(error.not_found.list));
                             return;
@@ -364,7 +408,7 @@ router.route('/api/list/:channel_name/__np__').post(function(req, res) {
                             res.status(404).send(JSON.stringify(error.not_authenticated));
                             return;
                         }
-                    updateTimeout(guid, res, "POST", function(err, docs) {
+                        updateTimeout(guid, res, authorized, "POST", function(err, docs) {
                             var to_return = error.no_error;
                             to_return.results = list;
                             res.status(200).send(JSON.stringify(to_return));
@@ -376,6 +420,7 @@ router.route('/api/list/:channel_name/__np__').post(function(req, res) {
             });
         });
     });
+});
 
 router.route('/api/list/:channel_name/:video_id').post(function(req,res) {
     res.header("Access-Control-Allow-Origin", "*");
@@ -385,6 +430,10 @@ router.route('/api/list/:channel_name/:video_id').post(function(req,res) {
     if(req.body.hasOwnProperty('fetch_song')) {
         fetch_only = true;
     }
+    var token = "";
+    if(req.body.hasOwnProperty("token")) {
+        token = req.body.token;
+    }
     if(!fetch_only && (!req.body.hasOwnProperty('adminpass') || !req.body.hasOwnProperty('userpass') ||
         !req.params.hasOwnProperty('channel_name') || !req.params.hasOwnProperty('video_id') ||
         !req.body.hasOwnProperty('duration') || !req.body.hasOwnProperty('start_time') ||
@@ -416,7 +465,12 @@ router.route('/api/list/:channel_name/:video_id').post(function(req,res) {
         return;
     }
 
-    checkTimeout(guid, res, "POST", function() {
+    token_db.collection("api_token").find({token: token}, function(err, token_docs) {
+        var authorized = false;
+        if(token_docs.length == 1 && token_docs.token == token) {
+            authorized = true;
+        }
+        checkTimeout(guid, res, authorized, "POST", function() {
             var type = fetch_only ? "fetch_song" : "add";
             validateLogin(adminpass, userpass, channel_name, type, res, function(exists, conf, authenticated) {
                 db.collection(channel_name).find({id: video_id}, function(err, result) {
@@ -457,12 +511,12 @@ router.route('/api/list/:channel_name/:video_id').post(function(req,res) {
                                                 } else {
                                                     io.to(channel_name).emit("suggested", new_song);
                                                 }
-                                            postEnd(channel_name, configs, new_song, guid, res, authenticated);
+                                                postEnd(channel_name, configs, new_song, guid, res, authenticated, authorized);
                                             });
                                         } else if(set_np) {
                                             Frontpage.update_frontpage(channel_name, video_id, title, function() {
                                                 io.to(channel_name).emit("np", {np: [new_song], conf: [conf]});
-                                            postEnd(channel_name, configs, new_song, guid, res, authenticated);
+                                                postEnd(channel_name, configs, new_song, guid, res, authenticated, authorized);
                                             });
                                         } else {
                                             db.collection("frontpage_lists").update({"_id": channel_name}, {$inc: {count: (authenticated ? 1 : 0)}}, function(err, docs) {
@@ -471,7 +525,7 @@ router.route('/api/list/:channel_name/:video_id').post(function(req,res) {
                                                 } else {
                                                     io.to(channel_name).emit("suggested", new_song);
                                                 }
-                                            postEnd(channel_name, configs, new_song, guid, res, authenticated);
+                                                postEnd(channel_name, configs, new_song, guid, res, authenticated, authorized);
                                             });
                                         }
                                     });
@@ -491,6 +545,7 @@ router.route('/api/list/:channel_name/:video_id').post(function(req,res) {
             });
         });
     });
+});
 
 router.route('/api/list/:channel_name').get(function(req, res) {
     res.header("Access-Control-Allow-Origin", "*");
@@ -500,7 +555,7 @@ router.route('/api/list/:channel_name').get(function(req, res) {
     var channel_name = req.params.channel_name;
     db.collection(channel_name).find({views: {$exists: false}}, toShowChannel, function(err, docs) {
         if(docs.length > 0) {
-            db.collection(channel_name + "_settings").find({views: {$exists: true}}, function(err, conf) {
+            db.collection(channel_name + "_settings").find({ id: "config" }, function(err, conf) {
                 if(conf.length == 0) {
                     res.status(404).send(JSON.stringify(error.not_found.list));
                     return;
@@ -530,7 +585,7 @@ router.route('/api/list/:channel_name/:video_id').get(function(req, res) {
         searchQuery = {now_playing: true};
     }
     db.collection(channel_name).find(searchQuery, toShowChannel, function(err, docs) {
-        db.collection(channel_name + "_settings").find({views: {$exists: true}}, function(err, conf) {
+        db.collection(channel_name + "_settings").find({ id: "config" }, function(err, conf) {
             if(conf.length == 0) {
                 res.status(404).send(JSON.stringify(error.not_found.list));
                 return;
@@ -556,7 +611,7 @@ router.route('/api/conf/:channel_name').get(function(req, res) {
     res.header({"Content-Type": "application/json"});
 
     var channel_name = req.params.channel_name;
-    db.collection(channel_name + "_settings").find({views: {$exists: true}}, toShowConfig, function(err, docs) {
+    db.collection(channel_name + "_settings").find({ id: "config" }, toShowConfig, function(err, docs) {
         if(docs.length > 0 && docs[0].userpass == "" || docs[0].userpass == undefined) {
             var conf = docs[0];
             if(conf.adminpass != "") {
@@ -591,6 +646,10 @@ router.route('/api/conf/:channel_name').post(function(req, res) {
         res.status(400).send(JSON.stringify(error.formatting));
         return;
     }
+    var token = "";
+    if(req.body.hasOwnProperty("token")) {
+        token = req.body.token;
+    }
     var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
     var guid = Functions.hash_pass(req.get('User-Agent') + ip + req.headers["accept-language"]);
     var channel_name = req.params.channel_name;
@@ -602,8 +661,13 @@ router.route('/api/conf/:channel_name').post(function(req, res) {
         return;
     }
 
-    checkTimeout(guid, res, "POST", function() {
-        db.collection(channel_name + "_settings").find({views: {$exists: true}}, toShowConfig, function(err, docs) {
+    token_db.collection("api_token").find({token: token}, function(err, token_docs) {
+        var authorized = false;
+        if(token_docs.length == 1 && token_docs.token == token) {
+            authorized = true;
+        }
+        checkTimeout(guid, res, authorized, "POST", function() {
+            db.collection(channel_name + "_settings").find({ id: "config" }, toShowConfig, function(err, docs) {
                 if(docs.length > 0 && docs[0].userpass == userpass) {
                     var conf = docs[0];
                     if(conf.adminpass != "") {
@@ -616,7 +680,7 @@ router.route('/api/conf/:channel_name').post(function(req, res) {
                     } else {
                         conf.userpass = false;
                     }
-                updateTimeout(guid, res, "POST", function(err, docs) {
+                    updateTimeout(guid, res, authorized, "POST", function(err, docs) {
                         var to_return = error.no_error;
                         to_return.results = conf;
                         res.status(200).send(JSON.stringify(to_return));
@@ -631,6 +695,7 @@ router.route('/api/conf/:channel_name').post(function(req, res) {
             });
         });
     });
+});
 
 router.route('/api/list/:channel_name').post(function(req, res) {
     res.header("Access-Control-Allow-Origin", "*");
@@ -642,6 +707,10 @@ router.route('/api/list/:channel_name').post(function(req, res) {
         return;
     }
 
+    var token = "";
+    if(req.body.hasOwnProperty("token")) {
+        token = req.body.token;
+    }
     var ip = req.headers['x-forwarded-for'] || req.connection.remoteAddress;
     var guid = Functions.hash_pass(req.get('User-Agent') + ip + req.headers["accept-language"]);
     var channel_name = req.params.channel_name;
@@ -653,10 +722,15 @@ router.route('/api/list/:channel_name').post(function(req, res) {
         return;
     }
 
-    checkTimeout(guid, res, "POST", function() {
+    token_db.collection("api_token").find({token: token}, function(err, token_docs) {
+        var authorized = false;
+        if(token_docs.length == 1 && token_docs.token == token) {
+            authorized = true;
+        }
+        checkTimeout(guid, res, authorized, "POST", function() {
             db.collection(channel_name).find({views: {$exists: false}}, toShowChannel, function(err, list) {
                 if(list.length > 0) {
-                db.collection(channel_name + "_settings").find({views: {$exists: true}}, function(err, conf) {
+                    db.collection(channel_name + "_settings").find({ id: "config" }, function(err, conf) {
                         if(conf.length == 0) {
                             res.status(404).send(JSON.stringify(error.not_found.list));
                             return;
@@ -664,7 +738,7 @@ router.route('/api/list/:channel_name').post(function(req, res) {
                             res.status(404).send(JSON.stringify(error.not_authenticated));
                             return;
                         }
-                    updateTimeout(guid, res, "POST", function(err, docs) {
+                        updateTimeout(guid, res, authorized, "POST", function(err, docs) {
                             var to_return = error.no_error;
                             to_return.results = list;
                             res.status(200).send(JSON.stringify(to_return));
@@ -676,6 +750,7 @@ router.route('/api/list/:channel_name').post(function(req, res) {
             });
         });
     });
+});
 
 router.route('/api/imageblob').post(function(req, res) {
     var Jimp = require("jimp");
@@ -747,11 +822,15 @@ try {
     });
 }
 
-function updateTimeout(guid, res, type, callback) {
-    db.collection("timeout_api").update({type: "DELETE", guid: guid}, {
+function updateTimeout(guid, res, authorized, type, callback) {
+    if(authorized) {
+        callback(null, null);
+        return;
+    }
+    db.collection("timeout_api").update({type: type, guid: guid}, {
         $set: {
             "createdAt": new Date(),
-            type: "DELETE",
+            type: type,
             guid: guid,
         },
     }, {upsert: true}, function(err, docs) {
@@ -759,7 +838,11 @@ function updateTimeout(guid, res, type, callback) {
     });
 }
 
-function checkTimeout(guid, res, type, callback) {
+function checkTimeout(guid, res, authorized, type, callback) {
+    if(authorized) {
+        callback();
+        return;
+    }
     db.collection("timeout_api").find({
         type: type,
         guid: guid,
@@ -788,7 +871,7 @@ function cleanChannelName(channel_name) {
 }
 
 function validateLogin(adminpass, userpass, channel_name, type, res, callback) {
-    db.collection(channel_name + "_settings").find({views: {$exists: true}}, function(err, conf) {
+    db.collection(channel_name + "_settings").find({ id: "config" }, function(err, conf) {
         var exists = false;
         if(conf.length > 0 && ((conf[0].userpass == undefined || conf[0].userpass == "" || conf[0].userpass == userpass))) {
             exists = true;
@@ -817,12 +900,12 @@ function validateLogin(adminpass, userpass, channel_name, type, res, callback) {
     });
 }
 
-function postEnd(channel_name, configs, new_song, guid, res, authenticated) {
+function postEnd(channel_name, configs, new_song, guid, res, authenticated, authorized) {
     if(configs != undefined) {
         io.to(channel_name).emit("conf", configs);
     }
     List.getNextSong(channel_name, function() {
-        updateTimeout(guid, res, "POST", function(err, docs) {
+        updateTimeout(guid, res, authorized, "POST", function(err, docs) {
             var to_return = error.no_error;
             if(!authenticated) {
                 to_return = error.not_authenticated;