remove session access in /name and /name/version, fixed #274

controllers/registry/module.js

@@ -56,22 +56,18 @@ exports.show = function *(next) {
     userMap[users[i]] = true;
   }
   users = userMap;
-  var session = yield *this.session;
-  debug('show module, user: %s, allowSync: %s, isAdmin: %s',
-    session.name, session.allowSync, session.isAdmin);
   // if module not exist in this registry,
   // sync the module backend and return package info from official registry
   if (rows.length === 0) {
-    if (!session.allowSync) {
+    if (!this.allowSync) {
       this.status = 404;
       this.body = {
         error: 'not_found',
         reason: 'document not found'
       };
       return;
     }
-    var username = (session && session.name) || 'anonymous';
-    var result = yield SyncModuleWorker.sync(name, username);
+    var result = yield SyncModuleWorker.sync(name, 'sync-by-install');
     this.status = result.ok ? 200 : result.statusCode;
     this.body = result.pkg;
     return;
@@ -187,9 +183,8 @@ exports.get = function *(next) {
     this.body = mod.package;
     return;
   }
-  var session = yield *this.session;
   // if not fond, sync from source registry
-  if (!session.allowSync) {
+  if (!this.allowSync) {
     this.status = 404;
     this.body = {
       error: 'not exist',
@@ -198,8 +193,7 @@ exports.get = function *(next) {
     return;
   }
 
-  var username = (session && session.username) || 'anonymous';
-  var result = yield SyncModuleWorker.sync(name, username);
+  var result = yield SyncModuleWorker.sync(name, 'sync-by-install');
   var pkg = result.pkg && result.pkg.versions[version];
   if (!pkg) {
     this.status = 404;

middleware/sync_by_install.js

@@ -30,19 +30,11 @@ module.exports = function *syncByInstall(next) {
   if (this.get('user-agent') && this.get('user-agent').indexOf('node') !== 0) {
     return yield *next;
   }
-  var session = {};
-  try {
-    session = yield *this.session;
-    session.allowSync = true;
-  } catch (err) {
-    console.warn('get session error in syncByInstall');
-    yield *next;
-  }
-  if (session.isAdmin) {
-    // if current user is admin, should not enable auto sync on install, because it would be unpublish
-    session.allowSync = false;
+
+  if (this.query.write) {
+    return yield *next;
   }
 
-  debug('%s allowSync: %s', session.name, session.allowSync);
+  this.allowSync = true;
   yield *next;
 };