juice-shop

1
/** Authorization **/
2
  /* Baskets: Unauthorized users are not allowed to access baskets */
3
  app.use('/rest/basket', security.isAuthorized(), security.appendUserId())
4
  /* BasketItems: API only accessible for authenticated users */
5
  app.use('/api/BasketItems', security.isAuthorized())
6
  app.use('/api/BasketItems/:id', security.isAuthorized())
7
  /* Feedbacks: GET allowed for feedback carousel, POST allowed in order to provide feedback without being logged in */
8
  app.use('/api/Feedbacks/:id', security.isAuthorized())
9
  /* Users: Only POST is allowed in order to register a new user */
10
  app.get('/api/Users', security.isAuthorized())
11
  app.route('/api/Users/:id')
12
    .get(security.isAuthorized())
13
    .put(security.denyAll())
14
    .delete(security.denyAll())
15
  /* Products: Only GET is allowed in order to view products */
16
  app.post('/api/Products', security.isAuthorized())
17
  app.put('/api/Products/:id', security.isAuthorized())
18
  app.delete('/api/Products/:id', security.denyAll())
19
  /* Challenges: GET list of challenges allowed. Everything else forbidden entirely */
20
  app.post('/api/Challenges', security.denyAll())
21
  app.use('/api/Challenges/:id', security.denyAll())
22
  /* Complaints: POST and GET allowed when logged in only */
23
  app.get('/api/Complaints', security.isAuthorized())
24
  app.post('/api/Complaints', security.isAuthorized())
25
  app.use('/api/Complaints/:id', security.denyAll())
26
  /* Recycles: POST and GET allowed when logged in only */
27
  app.get('/api/Recycles', recycles.blockRecycleItems())
28
  app.post('/api/Recycles', security.isAuthorized())
29
  /* Challenge evaluation before finale takes over */
30
  app.get('/api/Recycles/:id', recycles.getRecycleItem())
31
  app.put('/api/Recycles/:id', security.denyAll())
32
  app.delete('/api/Recycles/:id', security.denyAll())
33
  /* SecurityQuestions: Only GET list of questions allowed. */
34
  app.post('/api/SecurityQuestions', security.denyAll())
35
  app.use('/api/SecurityQuestions/:id', security.denyAll())
36
  /* SecurityAnswers: Only POST of answer allowed. */
37
  app.get('/api/SecurityAnswers', security.denyAll())
38
  app.use('/api/SecurityAnswers/:id', security.denyAll())
39
  /* REST API */
40
  app.use('/rest/user/authentication-details', security.isAuthorized())
41
  app.use('/rest/basket/:id', security.isAuthorized())
42
  app.use('/rest/basket/:id/order', security.isAuthorized())
43
  /* Unauthorized users are not allowed to access B2B API */
44
  app.use('/b2b/v2', security.isAuthorized())
45
  /* Check if the quantity is available in stock and limit per user not exceeded, then add item to basket */
46
  app.put('/api/BasketItems/:id', security.appendUserId(), basketItems.quantityCheckBeforeBasketItemUpdate())
47
  app.post('/api/BasketItems', security.appendUserId(), basketItems.quantityCheckBeforeBasketItemAddition(), basketItems.addBasketItem())
48
  /* Accounting users are allowed to check and update quantities */
49
  app.delete('/api/Quantitys/:id', security.denyAll())
50
  app.post('/api/Quantitys', security.denyAll())
51
  app.use('/api/Quantitys/:id', security.isAccounting(), ipfilter(['123.456.789'], { mode: 'allow' }))
52
  /* Feedbacks: Do not allow changes of existing feedback */
53
  app.put('/api/Feedbacks/:id', security.denyAll())
54
  /* PrivacyRequests: Only allowed for authenticated users */
55
  app.use('/api/PrivacyRequests', security.isAuthorized())
56
  app.use('/api/PrivacyRequests/:id', security.isAuthorized())
57
  /* PaymentMethodRequests: Only allowed for authenticated users */
58
  app.post('/api/Cards', security.appendUserId())
59
  app.get('/api/Cards', security.appendUserId(), payment.getPaymentMethods())
60
  app.put('/api/Cards/:id', security.denyAll())
61
  app.delete('/api/Cards/:id', security.appendUserId(), payment.delPaymentMethodById())
62
  app.get('/api/Cards/:id', security.appendUserId(), payment.getPaymentMethodById())
63
  /* PrivacyRequests: Only POST allowed for authenticated users */
64
  app.post('/api/PrivacyRequests', security.isAuthorized())
65
  app.get('/api/PrivacyRequests', security.denyAll())
66
  app.use('/api/PrivacyRequests/:id', security.denyAll())
67

68
  app.post('/api/Addresss', security.appendUserId())
69
  app.get('/api/Addresss', security.appendUserId(), address.getAddress())
70
  app.put('/api/Addresss/:id', security.appendUserId())
71
  app.delete('/api/Addresss/:id', security.appendUserId(), address.delAddressById())
72
  app.get('/api/Addresss/:id', security.appendUserId(), address.getAddressById())
73
  app.get('/api/Deliverys', delivery.getDeliveryMethods())
74
  app.get('/api/Deliverys/:id', delivery.getDeliveryMethod())