A Secure MongoDB like API

secure_db.coffee

# Now create a secure API to this
# library that requires authentication

# Users can only access these collections
collectionWhiteList = ["records", "sources", "searchers"]
# These collections don't need any authentication at all for
findWithNoAuthentication = ["sources"]

secureTemplate = (user, collectionName, cb, doneCB) ->
  if not user? or not user.accessToken?
    return cb(new Error("Unauthenticated: Must supply user with a valid accessToken to call this function"))
  if not _.include(collectionWhiteList, collectionName)
    return cb(new Error("Unauthenticated: You are not allowed to access the collection #{collectionName}"))
  else
    db.authenticate user, (err) ->
      return cb(err) if err?
      return doneCB()

exports.secure =
    authenticate: _.bind(db.authenticate, db)
    signin: _.bind(db.signin, db)
    signup: _.bind(db.signup, db)

    find: (user, collectionName, criteria, cb) ->
      if _.include(findWithNoAuthentication, collectionName)
        db.find(collectionName, criteria, cb)
      else secureTemplate user, collectionName, cb, ->
        db.find(collectionName, criteria, cb)

    findOne: (user, collectionName, criteria, cb) ->
      if _.include(findWithNoAuthentication, collectionName)
        db.findOne(collectionName, criteria, cb)
      else secureTemplate user, collectionName, cb, ->
        db.findOne(collectionName, criteria, cb)

    insert: (user, collectionName, objects, cb) ->
      secureTemplate user, collectionName, cb, ->
        db.insert(collectionName, objects, cb)

    update: (user, collectionName, objects, cb) ->
      secureTemplate user, collectionName, cb, ->
        db.update(collectionName, objects, cb)