Fixes for api access

Author: RyanBirtch-aot

app/src/forms/auth/middleware/apiAccess.js

@@ -75,10 +75,20 @@ const _getFormIdFromSubmissionId = async (formSubmissionId) => {
   return result?.form?.id;
 };
 
-module.exports = async (req, res, next) => {
-  try {
-    // Check if authorization header is basic auth
-    if (req.headers && req.headers.authorization && req.headers.authorization.startsWith('Basic ')) {
+module.exports = (options = {}) => {
+  const { required = false } = options;
+  return async (req, res, next) => {
+    try {
+      // Check if authorization header is basic auth
+      const hasBasicAuth = req.headers && req.headers.authorization && req.headers.authorization.startsWith('Basic ');
+
+      //validate that API Access is mandatory
+      if (required && !hasBasicAuth) {
+        throw new Problem(401, {
+          detail: HTTP_401_DETAIL,
+        });
+      }
+      if (!hasBasicAuth) return next();
       // URL params should override query string params of the same attribute
       const params = { ...req.query, ...req.params };
 
@@ -115,10 +125,8 @@ module.exports = async (req, res, next) => {
       });
 
       return checkCredentials(req, res, next);
-    } else {
-      next();
+    } catch (error) {
+      next(error);
     }
-  } catch (error) {
-    next(error);
-  }
+  };
 };

app/src/gateway/v1/auth/routes.js

@@ -7,7 +7,7 @@ const apiAccess = require('../../../forms/auth/middleware/apiAccess');
 const controller = require('./controller');
 
 // Issue a new token for a specific form
-router.post('/token/forms/:formId', apiAccess, controller.issueFormToken);
+router.post('/token/forms/:formId', apiAccess({ required: true }), controller.issueFormToken);
 
 // Refresh an existing token
 router.post('/refresh', controller.refreshToken);