<commit_before>const common = require('../../../../lib/common');
const auth = require('../../../../services/auth');
const shared = require('../../../shared');

const notImplemented = function (req, res, next) {
    // CASE: user is logged in, allow
    if (!req.api_key) {
        return next();
    }

    // @NOTE: integrations have limited access for now
    const whitelisted = {
        // @NOTE: stable
        site: ['GET'],
        posts: ['GET', 'PUT', 'DELETE', 'POST'],
        pages: ['GET', 'PUT', 'DELETE', 'POST'],
        images: ['POST'],
        // @NOTE: experimental
        tags: ['GET', 'PUT', 'DELETE', 'POST'],
        users: ['GET'],
        themes: ['POST', 'PUT'],
        members: ['GET', 'PUT', 'DELETE', 'POST'],
        config: ['GET'],
        webhooks: ['POST', 'DELETE'],
        schedules: ['PUT'],
        db: ['POST']
    };

    const match = req.url.match(/^\/(\w+)\/?/);

    if (match) {
        const entity = match[1];

        if (whitelisted[entity] && whitelisted[entity].includes(req.method)) {
            return next();
        }
    }

    next(new common.errors.GhostError({
        errorType: 'NotImplementedError',
        message: common.i18n.t('errors.api.common.notImplemented'),
        statusCode: '501'
    }));
};

/**
 * Authentication for private endpoints
 */
module.exports.authAdminApi = [
    auth.authenticate.authenticateAdminApi,
    auth.authorize.authorizeAdminApi,
    shared.middlewares.updateUserLastSeen,
    shared.middlewares.api.cors,<commit_msg>Removed unexisting member endpoints from API key access whitelist<commit_after>const common = require('../../../../lib/common');
const auth = require('../../../../services/auth');
const shared = require('../../../shared');

const notImplemented = function (req, res, next) {
    // CASE: user is logged in, allow
    if (!req.api_key) {
        return next();
    }

    // @NOTE: integrations have limited access for now
    const whitelisted = {
        // @NOTE: stable
        site: ['GET'],
        posts: ['GET', 'PUT', 'DELETE', 'POST'],
        pages: ['GET', 'PUT', 'DELETE', 'POST'],
        images: ['POST'],
        // @NOTE: experimental
        tags: ['GET', 'PUT', 'DELETE', 'POST'],
        users: ['GET'],
        themes: ['POST', 'PUT'],
        config: ['GET'],
        webhooks: ['POST', 'DELETE'],
        schedules: ['PUT'],
        db: ['POST']
    };

    const match = req.url.match(/^\/(\w+)\/?/);

    if (match) {
        const entity = match[1];

        if (whitelisted[entity] && whitelisted[entity].includes(req.method)) {
            return next();
        }
    }

    next(new common.errors.GhostError({
        errorType: 'NotImplementedError',
        message: common.i18n.t('errors.api.common.notImplemented'),
        statusCode: '501'
    }));
};

/**
 * Authentication for private endpoints
 */
module.exports.authAdminApi = [
    auth.authenticate.authenticateAdminApi,
    auth.authorize.authorizeAdminApi,
    shared.middlewares.updateUserLastSeen,
    shared.middlewares.api.cors,
{'fraction_non_alphanumeric': 0.19121023286323385, 'fraction_numerical': 0.003935716628402755, 'mean_word_length': 2.3516483516483517, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6427665', 'n_tokens_mistral': 943, 'n_tokens_neox': 911, 'n_words': 214}