access the initial request in the database adapter

[ianstormtaylor]

Is there any way to access the initial request inside the database adapter?

I'm building a custom adapter, because it talks over some internal APIs, and I'm not sure how to pass authentication/authorization information to the adapter so that it can forward them to the internal APIs.

If not, is there a workaround?

Edit: more specifically, I'm looking for a way to access the initial request inside getSnapshot and getOps, before they are called when a client first connects and loads a document.

[curran]

Here's the solution I'm using for exposing the session data to ShareDB Middleware:

const setup = (httpServer) => {
  const webSocketServer = new WebSocket.Server({
    server: httpServer
  })
  
  // When a new WebSocket connection is made,
  webSocketServer.on('connection', (webSocket, request) => {

    // look up the session from the upgrade reques cookie,
    getSession(request, (err, session) => {
      if (err) {
        return console.error(err)
      }

      // then expose the session on the upgrade request object,
      // so the access control middleware can access it.
      request.session = session

      // Connect the WebSocket to ShareDB.
      backend.listen(new JSONStream(webSocket), request)
    })
  })
} 

Here's getSession

// Gets the current session from a WebSocket connection.
// Draws from http://stackoverflow.com/questions/36842159/node-js-ws-and-express-session-how-to-get-session-object-from-ws-upgradereq
const getSession = (req, callback) => {
  const headers = req.headers  
    
  // If there's no cookie, there's no session, so do nothing.
  if (!headers.cookie) {       
    return callback()          
  }
  
  // If there's a cookie, get the session id from it.
  const cookies = cookie.parse(headers.cookie)
  const sessionId = cookieParser.signedCookie(cookies['connect.sid'], sessionSecret)
  
  // Get the session from the store and pass it to the callback.
  store.get(sessionId, callback)  
} 

Here's how it can be accessed in Middleware:

const get = require('lodash/get')
const { DB_FEEDBACK_COLLECTION } = require('../constants')

// This module implements access control rules at the ShareDB layer.
// This prevents, for example, editing documents you don't own.

// Middleware usage inspired by
// https://github.com/dmapper/sharedb-access/blob/master/lib/index.js
  
module.exports = (shareDB) => {
  
  // This ShareDB middleware triggers when new connections are made,
  // whether from the browser or from the server.
  shareDB.use('connect', (request, done) => {

    // If the connection is coming from the browser,
    if (request.req) {

      // expose the session to downstram middleware as agent.session.
      request.agent.session = request.req.session
    } else {
    
      // Otherwise set a flag that clarifies that
      // the connection is coming from the server (e.g. for creating User entries).
      request.agent.isServer = true
    }
  
    done()
  })
  
  // This middleware applies to all ops (changes).
  shareDB.use('apply', (request, done) => {
  
    // Unpack the ShareDB request object.
    const {
      op,
      agent: {
        isServer,
        session
      },
      snapshot,
      collection
    } = request

    // Get the id of the currently logged in user from the session.
    const userId = get(session, 'passport.user.id')

    // Get the owner id.
    const owner = (
      op.create
        ? (op.create.data || {}) // Handle the case of a creation op.
        : snapshot.data // Handle ops on an existing document.
    ).owner

    // Get the collaborators.
    const collaborators = get(snapshot, 'data.collaborators')

    // Access control rules:

    // Allow server code to do anything (e.g. create and update User entries).
    if (isServer) {
      return done()
    }

    // For all ops, owner must be the logged in user.
    if (!userId) {
      return done('You must be logged in to edit.')
    }

    // Check that the user is either the owner or a collaborator.
    if (owner !== userId) {
      const ids = (collaborators || []).map(({id}) => id)
      const isCollaborator = ids.filter(id => id === userId).length
      if (!isCollaborator) {
        return done('You must be the owner of this document or a collaborator in order to edit it.')
      }
    }

    done()
  })
}

[curran]

Perhaps the focus of this issue can be shifted to "Create an example in the examples directory that demonstrates authentication and access control".

[justinweiss]

I think there's a different issue than documentation, though:

Imagine you've written a DB adapter that talks to a remote service over an HTTP API. This API requires that requests be authenticated, and to make things simple and secure, you'd like to authenticate as the user who's reading snapshots and submitting ops. That way, you can rely on the remote server to control access.

Using @curran's solution, it's possible to submit ops on behalf of a user -- you can add a submit middleware that attaches whatever authentication param, session, or token to op.m, and you can read that back out in your DB adapter's commit method.

Unfortunately, there's no way in a middleware to attach data in such a way that a DB's getSnapshot or getOps can access it. This means that all ShareDB connections will have to share a single credential to access the API, and you'll have to block requests on the ShareDB side afterward.

[sergeytkachenko]

I want send user from http request to sharedb middleware fn. How to do it?

[sr258]

Great example that still works with version 2.2.1 in Jan 2021! Thanks a lot!

With this code I can authenticate users in ShareDB quite nicely. I think it would be really useful to add this to the examples or docs, as adding authentication is not really documented anywhere except for here in this issue.