diff --git a/README.md b/README.md
index 8304e06..ce80265 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,8 @@ DRONE SERIES - WEBAPI IMPLEMENT PRODUCER API
## Configuration
Configuration files are located under `config` dir.
-See https://github.com/lorenwest/node-config/wiki/Configuration-Files
+See https://github.com/lorenwest/node-config/wiki/Configuration-Files
+Some settings (e.g AWS credentials) must be set only as Environment variables. Check file custom-environment-variables.json for full list.
|Name|Description|
|----|-----------|
@@ -30,6 +31,12 @@ See https://github.com/lorenwest/node-config/wiki/Configuration-Files
|`mail.EMAIL_FROM`| The from email address |
|`mail.SMTP_USERNAME`| The smtp username |
|`mail.SMTP_PASSWORD`| The smtp password |
+|`AWS_ACCESS_KEY`| The AWS Access Key see http://docs.aws.amazon.com/general/latest/gr/managing-aws-access-keys.html |
+|`AWS_SECRET_KEY`| The AWS Secret Key |
+|`AWS_REGION`| Your AWS access region. You should use all services from the same region (Currently only S3 is used). |
+|`S3_BUCKET`| The S3 bucket name for file upload. |
+
+AWS settings are optional to set, but file upload will not working (you can use other features).
## Mail service configuration
@@ -137,4 +144,46 @@ you also can export those values before run(data from forum).
`export SMTP_PASSWORD="yourpassword"`
`export EMAIL_FROM="your@email.com"`
-force push 1/11/2017
+# S3 setup
+- Open S3 console https://console.aws.amazon.com/s3
+- Create Bucket
+- Check `Region Name` to `Code` mapping here http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html and set `AWS_REGION`
+- Select tab **Properties** from the top right menu
+- Expand **Permissions** tab
+- Click on **Add bucket policy** and set below policy
+```
+{
+ "Version": "2008-10-17",
+ "Statement": [
+ {
+ "Sid": "AllowPublicRead",
+ "Effect": "Allow",
+ "Principal": {
+ "AWS": "*"
+ },
+ "Action": "s3:GetObject",
+ "Resource": "arn:aws:s3:::dsp-21472/*"
+ }
+ ]
+}
+```
+Update `dsp-21472` to your bucket name.
+
+- Click on **Add CORS Configuration** and set below policy
+```
+
+
+
+ *
+ GET
+ PUT
+ POST
+ DELETE
+ 3000
+ *
+
+
+
+
+```
+In production mode, you should restrict `AllowedOrigin`.
\ No newline at end of file
diff --git a/bootstrap.js b/bootstrap.js
index 63e2792..d58f078 100644
--- a/bootstrap.js
+++ b/bootstrap.js
@@ -11,7 +11,35 @@
global.Promise = require('bluebird');
const Joi = require('joi');
+const _ = require('lodash');
const logger = require('./common/logger');
+const AWS = require('aws-sdk-promise');
+const config = require('config');
+
+// Validate AWS config
+Joi.validate(_.pick(config, 'AWS_ACCESS_KEY', 'AWS_SECRET_KEY', 'AWS_REGION', 'S3_BUCKET'),
+ {
+ AWS_ACCESS_KEY: Joi.string().required(),
+ AWS_SECRET_KEY: Joi.string().required(),
+ AWS_REGION: Joi.string().required(),
+ S3_BUCKET: Joi.string().required(),
+ }, (err) => {
+ if (err) {
+ logger.logFullError(err, 'AWS CREDENTIALS VALIDATION');
+ // allow to use app if s3 is not configured in DEV mode
+ if (process.env.NODE_ENV === 'production') {
+ process.exit(0);
+ }
+ return;
+ }
+ AWS.config.update({
+ s3: '2006-03-01',
+ sts: '2011-06-15',
+ accessKeyId: config.AWS_ACCESS_KEY,
+ secretAccessKey: config.AWS_SECRET_KEY,
+ region: config.AWS_REGION,
+ });
+ });
// add joi types
Joi.objectId = () => Joi.string().regex(/^[a-f0-9]{24}$/);
@@ -40,3 +68,4 @@ logger.buildService(require('./services/NotificationService'));
logger.buildService(require('./services/ServiceServices'));
logger.buildService(require('./services/DronePositionService'));
logger.buildService(require('./services/NoFlyZoneService'));
+logger.buildService(require('./services/AWSService'));
diff --git a/common/Permission.js b/common/Permission.js
index cfb3940..9983d9b 100644
--- a/common/Permission.js
+++ b/common/Permission.js
@@ -39,25 +39,32 @@ function providerRoleCheck(req, res, next) {
next();
});
}
+
/**
* check the user permission
- * if user role not pilot, then cannot perform pilot actions
+ * if user role not pilot or provider, then cannot ask provider resource
* @param req
* @param res
* @param next
*/
-function pilotRoleCheck(req, res, next) {
+function pilotProviderRoleCheck(req, res, next) {
User.findOne({_id: req.auth.sub}, (err, user) => {
if (!user) {
- throw new errors.AuthenticationRequiredError('Anonymous is not allowed to access', 401);
+ next(new errors.AuthenticationRequiredError('Anonymous is not allowed to access', 401));
+ return;
}
- if (user.role !== Role.PILOT) {
- throw new errors.NotPermittedError('Non-pilot is not allowed to access', 403);
+ if ((user.role !== Role.PROVIDER || !user.provider) && (user.role !== Role.PILOT)) {
+ next(new errors.NotPermittedError('User who is not either provider or pilot is not allowed to access', 403));
+ return;
}
+
req.auth.payload = {
- role: Role.PILOT,
+ role: user.role
};
+ if (user.role === Role.PROVIDER) {
+ req.auth.payload.providerId = user.provider.toString();
+ }
next();
});
}
@@ -67,7 +74,7 @@ module.exports = {
providerRole() {
return providerRoleCheck;
},
- pilotRole() {
- return pilotRoleCheck;
+ pilotProviderRole() {
+ return pilotProviderRoleCheck;
},
};
diff --git a/common/logger.js b/common/logger.js
old mode 100755
new mode 100644
index 0de4fcf..9ccc516
--- a/common/logger.js
+++ b/common/logger.js
@@ -52,8 +52,8 @@ function _sanitizeObject(obj) {
return JSON.parse(JSON.stringify(obj, (name, value) => {
// Array of field names that should not be logged
// add field if necessary (password, tokens etc)
- const removeFields = [];
- if (_.contains(removeFields, name)) {
+ const removeFields = ['secretAccessKey', 'sessionToken', 'password'];
+ if (_.includes(removeFields, name)) {
return '