lib/utils.js
function(doRecentCheck, req, res, next) {
  var app = req.app;
  var config = app.loadConfig('auth');

  var failed = !req.isAuthenticated();
  if (!failed && doRecentCheck && !req.session.impersonated) {
    //skip recent check if login is impersonated
    //note: loginTime maybe a string since sessions are serialized as json
    failed = !req.session.loginTime ||
      !(new Date() - new Date(req.session.loginTime) <= config.recentLoginTimeoutSeconds*1000);
    if (failed) { //force reauthentication (e.g. for facebook login for example)
      req.session.reauthenticate  = true;
    }
  }

  // if user is not authenticated, redirect to login
  if (failed) {
    // remember original requested url
    req.session.returnTo = req.url;
    req.session.returnToMethod = req.method;
    req.flash('login.danger', req.session.reauthenticate ? 'You need to login again to access this page.' : 'You need to login to access this page.');
    res.redirect('/login');
    return;
  }

  if (config.requireEmailVerification
      && req.user && !req.user.local.verified) {
    if (config.requireEmailVerification == 'nag') {
      req.flash('warning', 'Please confirm your email address by clicking the link sent to <strong>'+ req.user.local.email +"</strong>.&nbsp;&nbsp;<a class='send-resend' href='#'>Resend confirmation email</a>.");
    } else if (config.requireEmailVerification == 'require') {
      // redirect to the email verification page
      req.session.returnTo = req.url;
      req.session.returnToMethod = req.method;
      res.redirect('/verification-required');
      return;
    }
  }

  return next();
}
function(doRecentCheck, req, res, next) {
  var app = req.app;
  var config = app.loadConfig('auth');

  var failed = !req.isAuthenticated();
  if (!failed && doRecentCheck && !req.session.impersonated) {
    //skip recent check if login is impersonated
    //note: loginTime maybe a string since sessions are serialized as json
    failed = !req.session.loginTime ||
      !(new Date() - new Date(req.session.loginTime) <= config.recentLoginTimeoutSeconds*1000);
    if (failed) { //force reauthentication (e.g. for facebook login for example)
      req.session.reauthenticate  = true;
    }
  }

  // if user is not authenticated, redirect to login
  if (failed) {
    // remember original requested url
    req.session.returnTo = req.url;
    req.session.returnToMethod = req.method;
    req.flash('login.danger', req.session.reauthenticate ? 'You need to login again to access this page.' : 'You need to login to access this page.');
    res.redirect('/login');
    return;
  }

  if (config.requireEmailVerification
      && req.user && !req.user.local.verified) {
    if (config.requireEmailVerification == 'nag') {
      req.flash('warning', 'Please confirm your email address by clicking the link sent to <strong>'+ req.user.local.email +"</strong>.&nbsp;&nbsp;<a class='send-resend' href='#'>Resend confirmation email</a>.");
    } else if (config.requireEmailVerification == 'require') {
      // redirect to the email verification page
      req.session.returnTo = req.url;
      req.session.returnToMethod = req.method;
      res.redirect('/verification-required');
      return;
    }
  }

  return next();
}
function ( doRecentCheck , req , res , next ) { var app = req . app ; var config = app . loadConfig ( 'auth' ) ; var failed = ! req . isAuthenticated ( ) ; if ( ! failed && doRecentCheck && ! req . session . impersonated ) { //skip recent check if login is impersonated //note: loginTime maybe a string since sessions are serialized as json failed = ! req . session . loginTime || ! ( new Date ( ) - new Date ( req . session . loginTime ) <= config . recentLoginTimeoutSeconds * 1000 ) ; if ( failed ) { //force reauthentication (e.g. for facebook login for example) req . session . reauthenticate = true ; } } // if user is not authenticated, redirect to login if ( failed ) { // remember original requested url req . session . returnTo = req . url ; req . session . returnToMethod = req . method ; req . flash ( 'login.danger' , req . session . reauthenticate ? 'You need to login again to access this page.' : 'You need to login to access this page.' ) ; res . redirect ( '/login' ) ; return ; } if ( config . requireEmailVerification && req . user && ! req . user . local . verified ) { if ( config . requireEmailVerification == 'nag' ) { req . flash ( 'warning' , 'Please confirm your email address by clicking the link sent to <strong>' + req . user . local . email + "</strong>.&nbsp;&nbsp;<a class='send-resend' href='#'>Resend confirmation email</a>." ) ; } else if ( config . requireEmailVerification == 'require' ) { // redirect to the email verification page req . session . returnTo = req . url ; req . session . returnToMethod = req . method ; res . redirect ( '/verification-required' ) ; return ; } } return next ( ) ; }
route middleware to make sure a user is logged in
route middleware to make sure a user is logged in