From 5d1b31e8237aea2a8079a265bfadde1d5052c9bb Mon Sep 17 00:00:00 2001 From: williamlardier Date: Fri, 6 Dec 2024 17:22:58 +0100 Subject: [PATCH] Ensure backbeat retrieve the account quotas The route backbeat also calls the doAuth function, but we never map the value to accountQuotas Issue: CLDSRV-590 --- lib/routes/routeBackbeat.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/routes/routeBackbeat.js b/lib/routes/routeBackbeat.js index 15e53b10c9..e081c46e9b 100644 --- a/lib/routes/routeBackbeat.js +++ b/lib/routes/routeBackbeat.js @@ -1388,7 +1388,7 @@ function routeBackbeat(clientIP, request, response, log) { const path = request.url.replace('/_/backbeat/api', '/_/'); const { host, port } = config.backbeat; const target = `http://${host}:${port}${path}`; - return auth.server.doAuth(request, log, (err, userInfo) => { + return auth.server.doAuth(request, log, (err, userInfo, streamingV4Params, infos) => { if (err) { log.debug('authentication error', { error: err, @@ -1398,6 +1398,8 @@ function routeBackbeat(clientIP, request, response, log) { }); return responseJSONBody(err, null, response, log); } + // eslint-disable-next-line no-param-reassign + request.accountQuotas = infos?.accountQuota; // FIXME for now, any authenticated user can access API // routes. We should introduce admin accounts or accounts // with admin privileges, and restrict access to those