juice-shop

1
/** Authorization **/
2
  /* Baskets: Unauthorized users are not allowed to access baskets */
3
  app.use('/rest/basket', security.isAuthorized(), security.appendUserId())
4
  /* BasketItems: API only accessible for authenticated users */
5
  app.use('/api/BasketItems', security.isAuthorized())
6
  app.use('/api/BasketItems/:id', security.isAuthorized())
7
  /* Feedbacks: GET allowed for feedback carousel, POST allowed in order to provide feedback without being logged in */
8
  app.use('/api/Feedbacks/:id', security.isAuthorized())
9
  /* Users: Only POST is allowed in order to register a new user */
10
  app.get('/api/Users', security.isAuthorized())
11
  app.route('/api/Users/:id')
12
    .get(security.isAuthorized())
13
    .put(security.denyAll())
14
    .delete(security.denyAll())
15
  /* Products: Only GET is allowed in order to view products */
16
  app.post('/api/Products', security.isAuthorized())
17
  app.delete('/api/Products/:id', security.denyAll())
18
  /* Challenges: GET list of challenges allowed. Everything else forbidden entirely */
19
  app.post('/api/Challenges', security.denyAll())
20
  app.use('/api/Challenges/:id', security.denyAll())
21
  /* Complaints: POST and GET allowed when logged in only */
22
  app.get('/api/Complaints', security.isAuthorized())
23
  app.post('/api/Complaints', security.isAuthorized())
24
  app.use('/api/Complaints/:id', security.denyAll())
25
  /* Recycles: POST and GET allowed when logged in only */
26
  app.get('/api/Recycles', recycles.blockRecycleItems())
27
  app.post('/api/Recycles', security.isAuthorized())
28
  /* Challenge evaluation before finale takes over */
29
  app.get('/api/Recycles/:id', recycles.getRecycleItem())
30
  app.put('/api/Recycles/:id', security.denyAll())
31
  app.delete('/api/Recycles/:id', security.denyAll())
32
  /* SecurityQuestions: Only GET list of questions allowed. */
33
  app.post('/api/SecurityQuestions', security.denyAll())
34
  app.use('/api/SecurityQuestions/:id', security.denyAll())
35
  /* SecurityAnswers: Only POST of answer allowed. */
36
  app.get('/api/SecurityAnswers', security.denyAll())
37
  app.use('/api/SecurityAnswers/:id', security.denyAll())
38
  /* REST API */
39
  app.use('/rest/user/authentication-details', security.isAuthorized())
40
  app.use('/rest/basket/:id', security.isAuthorized())
41
  app.use('/rest/basket/:id/order', security.isAuthorized())
42
  /* Unauthorized users are not allowed to access B2B API */
43
  app.use('/b2b/v2', security.isAuthorized())
44
  /* Check if the quantity is available in stock and limit per user not exceeded, then add item to basket */
45
  app.put('/api/BasketItems/:id', security.appendUserId(), basketItems.quantityCheckBeforeBasketItemUpdate())
46
  app.post('/api/BasketItems', security.appendUserId(), basketItems.quantityCheckBeforeBasketItemAddition(), basketItems.addBasketItem())
47
  /* Accounting users are allowed to check and update quantities */
48
  app.delete('/api/Quantitys/:id', security.denyAll())
49
  app.post('/api/Quantitys', security.denyAll())
50
  app.use('/api/Quantitys/:id', security.isAccounting(), ipfilter(['123.456.789'], { mode: 'allow' }))
51
  /* Feedbacks: Do not allow changes of existing feedback */
52
  app.put('/api/Feedbacks/:id', security.denyAll())
53
  /* PrivacyRequests: Only allowed for authenticated users */
54
  app.use('/api/PrivacyRequests', security.isAuthorized())
55
  app.use('/api/PrivacyRequests/:id', security.isAuthorized())
56
  /* PaymentMethodRequests: Only allowed for authenticated users */
57
  app.post('/api/Cards', security.appendUserId())
58
  app.get('/api/Cards', security.appendUserId(), payment.getPaymentMethods())
59
  app.put('/api/Cards/:id', security.denyAll())
60
  app.delete('/api/Cards/:id', security.appendUserId(), payment.delPaymentMethodById())
61
  app.get('/api/Cards/:id', security.appendUserId(), payment.getPaymentMethodById())
62
  /* PrivacyRequests: Only POST allowed for authenticated users */
63
  app.post('/api/PrivacyRequests', security.isAuthorized())
64
  app.get('/api/PrivacyRequests', security.denyAll())
65
  app.use('/api/PrivacyRequests/:id', security.denyAll())
66

67
  app.post('/api/Addresss', security.appendUserId())
68
  app.get('/api/Addresss', security.appendUserId(), address.getAddress())
69
  app.put('/api/Addresss/:id', security.appendUserId())
70
  app.delete('/api/Addresss/:id', security.appendUserId(), address.delAddressById())
71
  app.get('/api/Addresss/:id', security.appendUserId(), address.getAddressById())
72
  app.get('/api/Deliverys', delivery.getDeliveryMethods())
73
  app.get('/api/Deliverys/:id', delivery.getDeliveryMethod())