Auth token middleware for Connect.

auth-token.js

var _ = require('underscore');

/*
 * Auth token middleware for Connect.
 *
 * Looks at the `X-Auth-Token` header and compares it against `authToken`.
 *
 * `authToken` can be a string or a function that takes an input authentication
 * token and returns a boolean that indicates whether authentication succeeds.
 */
module.exports = function authToken(authToken) {
    if (!authToken) {
        throw new Error(
            '`authToken` must be a string or a function that takes an input ' +
            'authentication token and returns a boolean that indicates ' +
            'whether authentication succeeds.'
        );
    }

    function unauthorized(res, message) {
        res.status(401).send({message: message}).end();
    };

    return function(req, res, next) {
        var reqAuthToken = req.headers['x-auth-token'];

        // Bail early if the auth token was not sent with the request.
        if (!reqAuthToken) {
            return unauthorized(
                res,
                'Authentication token must be sent via the X-Auth-Token header.'
            );
        }

        // Validate auth token.
        var isAuthorized = false;

        if (_.isString(authToken)) {
            isAuthorized = (reqAuthToken == authToken);
        }
        else if (_.isFunction(authToken)) {
            isAuthorized = authToken(reqAuthToken);
        }

        // Bad auth token.
        if (!isAuthorized) {
            return unauthorized(res, 'Bad authentication token');
        }
        
        // Good auth token.
        return next();
    };
};