feat: [backend] better streaming auth
This commit is contained in:
@@ -108,14 +108,9 @@ export class StreamingApiServerService {
|
|||||||
try {
|
try {
|
||||||
[user, app] = await this.authenticateService.authenticate(token);
|
[user, app] = await this.authenticateService.authenticate(token);
|
||||||
|
|
||||||
if (app !== null && !app.permission.some(p => p === 'read:account')) {
|
if ((app !== null && !app.permission.some(p => p === 'read:account')) || user == null) {
|
||||||
throw new AuthenticationError('Your app does not have necessary permissions to use websocket API.');
|
throw new AuthenticationError('Your app does not have necessary permissions to use websocket API.');
|
||||||
}
|
}
|
||||||
|
|
||||||
// Ensure we have a valid user
|
|
||||||
if (!user) {
|
|
||||||
throw new AuthenticationError('Invalid token or user not found.');
|
|
||||||
}
|
|
||||||
} catch (e) {
|
} catch (e) {
|
||||||
if (e instanceof AuthenticationError) {
|
if (e instanceof AuthenticationError) {
|
||||||
socket.write([
|
socket.write([
|
||||||
|
|||||||
Reference in New Issue
Block a user