Users can only access their own pages

3 files changed, 13 insertions, 5 deletions

diff --git a/app.coffee b/app.coffee
index a5c1ecdf..b86336a3 100644
--- a/app.coffee
+++ b/app.coffee
@@ -1,16 +1,13 @@
 express = require('express')
 path = require('path')
 engines = require('consolidate')
-passport = require('./passport').passport
+passport = require('./passport')
 
 calculator = require("./routes/calculator")
 sessions = require("./routes/sessions")(passport)
 transactions = require("./routes/transactions")
 users = require("./routes/users")
 
-authorize = (req, res, next) ->
-  return next() if req.isAuthenticated()
-  res.redirect('/login')
 
 app = express()
 app.enable('trust proxy')
@@ -46,12 +43,19 @@ for route, view of routes
     )
   )(route, view) 
 
+authorize = (req, res, next) ->
+  return next() if req.isAuthenticated() and
+    req.params.user is req.user.username or 
+    req.user.username is 'admin'
+  res.redirect('/login')
+
 app.get('/setup', calculator.new)
 app.get('/calculator', calculator.show)
 app.get('/ticker', calculator.ticker)
 
 app.get('/login', sessions.new)
 app.post('/login', sessions.create)
+app.get('/logout', sessions.destroy)
 
 app.get('/:user.json', authorize, users.json)
 app.get('/:user', authorize, users.show)
diff --git a/passport.coffee b/passport.coffee
index 280117d1..05a4c68c 100644
--- a/passport.coffee
+++ b/passport.coffee
@@ -27,4 +27,4 @@ passport.use(new LocalStrategy(
     )
 ))
 
-exports.passport = passport
+module.exports = passport
diff --git a/routes/sessions.coffee b/routes/sessions.coffee
index 631004ca..50719394 100644
--- a/routes/sessions.coffee
+++ b/routes/sessions.coffee
@@ -17,3 +17,7 @@ module.exports = (passport) ->
         return res.redirect('/' + user.username)
       )
     )(req, res, next)
+
+  destroy: (req, res) ->
+    req.logout()
+    res.redirect('/login')