implements static policies

src/express/middleware/createAuthHeaderFromCookie.js

@@ -1,6 +1,7 @@
 const createAuthHeaderFromCookie = config => (req, _, next) => {
-  if (process.env.NODE_ENV !== 'production' || config.productionGraphQLPlayground) {
-    const existingAuthHeader = req.get('Authorization');
+  const existingAuthHeader = req.get('Authorization');
+
+  if (req.cookies) {
     const token = req.cookies[`${config.cookiePrefix}-token`];
 
     if (!existingAuthHeader && token) {

src/express/middleware/index.js

@@ -17,6 +17,7 @@ const middleware = (config) => {
   return [
     passport.initialize(),
     passport.session(),
+    authenticate(config),
     express.json(),
     cookieParser(),
     methodOverride('X-HTTP-Method-Override'),
@@ -24,7 +25,6 @@ const middleware = (config) => {
     bodyParser.urlencoded({ extended: true }),
     compression(config.compression),
     localizationMiddleware(config.localization),
-    authenticate(config),
     identifyAPI('REST'),
     fileUpload({
       parseNested: true,

src/express/static.js

@@ -1,13 +1,27 @@
 const express = require('express');
+const passport = require('passport');
+const cookieParser = require('cookie-parser');
 const getExecuteStaticPolicy = require('../auth/getExecuteStaticPolicy');
+const authenticate = require('./middleware/authenticate');
+const createAuthHeaderFromCookie = require('./middleware/createAuthHeaderFromCookie');
 
 function initStatic() {
   Object.entries(this.collections).forEach(([_, collection]) => {
     const { config } = collection;
 
     if (config.upload) {
-      this.express.use(`${config.upload.staticURL}`, getExecuteStaticPolicy(collection));
-      this.express.use(`${config.upload.staticURL}`, express.static(config.upload.staticDir));
+      const router = express.Router();
+
+      router.use(cookieParser());
+      router.use(createAuthHeaderFromCookie(this.config));
+      router.use(passport.initialize());
+      router.use(passport.session());
+      router.use(authenticate(this.config));
+
+      router.use(getExecuteStaticPolicy(collection));
+      router.use(express.static(config.upload.staticDir));
+
+      this.express.use(`${config.upload.staticURL}`, router);
     }
   });
 }