From 350c22887d89c3f0952e1d67d343d53f48dc8d6a Mon Sep 17 00:00:00 2001 From: Elizabeth Cray Date: Sun, 26 Jul 2026 22:40:07 -0400 Subject: [PATCH] Fixed updated auth handling --- adapt.js | 11 +++++--- basicauth_serve.js | 65 ++++++++++++++++++---------------------------- 2 files changed, 33 insertions(+), 43 deletions(-) diff --git a/adapt.js b/adapt.js index baa7cd5..c8d94a4 100644 --- a/adapt.js +++ b/adapt.js @@ -24,17 +24,19 @@ app.all(/.*/, (req, res) => { let hazePwHash = null; let hazeUser = null; if (req.query.auth) { - request({ + let api_data = { ...reqOpts, url: reqOpts.url + req.baseUrl, headers: { Authorization: `Basic ${req.query.auth}` } - }, (error, response, body) => { + }; + request(api_data, (error, response, body) => { if (error) { res.status(500).send('Internal Server Error'); return; } else if (response.statusCode !== 200) { + console.dir(api_data); res.status(response.statusCode).send(body); return; } else { @@ -42,9 +44,12 @@ app.all(/.*/, (req, res) => { res.send(body); } }) + } else { + res.status(401).send('Unauthorized'); + return; } }); app.listen(port, () => { console.log(`Server is running on http://localhost:${port}`); -}); \ No newline at end of file +}); diff --git a/basicauth_serve.js b/basicauth_serve.js index 896b984..dc34e05 100644 --- a/basicauth_serve.js +++ b/basicauth_serve.js @@ -1,6 +1,5 @@ const express = require('express'); const WebSocket = require('ws'); -const auth = require('express-basic-auth'); const { createHash } = require('crypto'); @@ -95,42 +94,29 @@ const hazeTranslator = { "Bats" ] }; -app.use(auth({ - authorizer: (username, password) => { - return true; - } -})); // Assemble full Haze location data, can take a LONG time app.all('/locations_full.geojson', (req, res) => { // Verify Inputs - if ((!req.auth.user || !req.auth.password) && (!req.query.auth)) { + if (!req.headers['authorization']) { res.status(401).send('Unauthorized'); return; } - - // Setup local variables for request + // Setup standard authentication variables let hazePwHash = null; let hazeUser = null; - let hazeSocketCounter = 0; - let requestStartTime = new Date().getTime(); - if (req.query.auth) { - let paramAuth = Buffer.from(req.query.auth, 'base64').toString('utf-8'); - hazeUser = paramAuth.split(":")[0]; - hazePwHash = paramAuth.split(":")[1]; - } else { - hazeUser = req.auth.user; - if (/\b[A-Fa-f0-9]{64}\b/.test(req.auth.password)) { - hazePwHash = req.auth.password; - } else { - hazePwHash = createHash('sha256').update(req.auth.password).digest('hex'); - } + let authHeader = req.headers['authorization']; + let paramAuth = Buffer.from(authHeader.replace('Basic ', ''), 'base64').toString('utf-8'); + hazeUser = paramAuth.split(":")[0]; + hazePwHash = paramAuth.split(":")[1].replace(/\r?\n|\r/g, ''); + if (!/\b[A-Fa-f0-9]{64}\b/.test(hazePwHash)) { + hazePwHash = createHash('sha256').update(hazePwHash).digest('hex'); } const haze = new WebSocket('wss://do.ecven.com:8120/explr-mb'); let locations = []; let failCounter = 0; let queryComplete = false; - + console.log(`Starting request at ${new Date().toISOString()} for ${hazeUser}`); // Socket Message Handlers, defined here to use the local variables above const sendComplete = () => { if (!queryComplete) { @@ -234,7 +220,7 @@ app.all('/locations_full.geojson', (req, res) => { } }); queryLocation(locations.findIndex(location => location && location.completed === 0)); - + } else { console.dir(data); res.status(500).send('Failed to retrieve locations'); @@ -302,26 +288,25 @@ app.all('/locations_full.geojson', (req, res) => { // Original API, for only listing locations with minimal data app.all('/locations.geojson', (req, res) => { // Verify Inputs - if ((!req.auth.user || !req.auth.password) && (!req.query.auth)) { + if (!req.headers['authorization']) { res.status(401).send('Unauthorized'); return; } - // Query Haze API Websocket + // Setup standard authentication variables let hazePwHash = null; let hazeUser = null; - if (req.query.auth) { - let paramAuth = Buffer.from(req.query.auth, 'base64').toString('utf-8'); - hawUser = paramAuth.split(":")[0]; - hazePwHash = paramAuth.split(":")[1]; - } else { - hazeUser = req.auth.user; - if (/\b[A-Fa-f0-9]{64}\b/.test(req.auth.password)) { - hazePwHash = req.auth.password; - } else { - hazePwHash = createHash('sha256').update(req.auth.password).digest('hex'); - } + let authHeader = req.headers['authorization']; + let paramAuth = Buffer.from(authHeader.replace('Basic ', ''), 'base64').toString('utf-8'); + hazeUser = paramAuth.split(":")[0]; + hazePwHash = paramAuth.split(":")[1].replace(/\r?\n|\r/g, ''); + if (!/\b[A-Fa-f0-9]{64}\b/.test(hazePwHash)) { + hazePwHash = createHash('sha256').update(hazePwHash).digest('hex'); } - const haze = new WebSocket('wss://do.ecven.com:8120/explr'); + + // At this point we need hazeUser as the email and hazePwHas as the sha256 hashed password + // Query Haze API Websocket + console.log(`Starting request at ${new Date().toISOString()} for ${hazeUser}`); + const haze = new WebSocket('wss://do.ecven.com:8120/explr-mb'); haze.addEventListener('message', (event) => { const data = JSON.parse(event.data); let haze_authToken = '', haze_username = ''; @@ -345,7 +330,7 @@ app.all('/locations.geojson', (req, res) => { haze.send('{"event": "getMyLocationsRequest_request","body": [{"higlightImages": true}],"socketMessageId": 0}'); } else { console.dir(req.query); - res.status(401).json({ ...data, password: req.auth.password }); + res.status(401).json({ ...data }); haze.close(); res.end(); } @@ -369,7 +354,7 @@ app.all('/locations.geojson', (req, res) => { res.setHeader('Content-Type', 'application/json'); haze.close(); res.end(JSON.stringify({ - ...geonJsonTemplate, + ...geoJsonTemplate, features: hazeLocations })); } else {