// basic authenticatin with jwt
var jwt = require('jwt-simple');

// config should contain secret for
var config = require('./config');

exports.setup = function (app) {

  app.post('/auth', function (req, res) {
    if(req.body.name === config.user.name &&
       req.body.pass === config.user.pass) {

      res.json({
        token: jwt.encode({
          admin: true,
          issued: (new Date())
        }, config.secret)
      });

    } else {

      res.status(400).json({
        message: 'incorrect login'
      });

    }
  });

  // enable auth on all api routes
  // check http header for TOKEN
  // ex: Authorization: Bearer TOKEN
  app.use(function (req, res, next) {
    if (req.headers.authorization === undefined) {
      res.status(400).json({
        message: 'need to provide \'Authorization\' header'
      });
    } else {
      var token = req.headers.authorization.match('Bearer (.*)');
      if (token === null) {
        res.status(400).json({
          message: 'malformed \'Authorization\' header'
        });
      } else {
        token = token[1];
        try {
          var decoded = jwt.decode(token, config.secret);
          if (decoded.admin === undefined) {
            res.status(403).json({
              message: 'unknown user - reauthenticate'
            });
          } else {
            next();
          }
        } catch (_) {
          res.status(400).json({
            message: 'malformed \'Authorization\' header'
          });
        }
      }
    }
  });

};

@@ -686,16 +686,48 @@
     if (
+req.query.auth === undefined && 
 req.head
@@ -840,32 +840,50 @@
 ization%5C' header
+ or %5C'auth%5C' param
 '%0A      %7D);%0A    
@@ -908,16 +908,34 @@
  token =
+ req.query.auth %7C%7C
  req.hea
@@ -1058,42 +1058,27 @@
 e: '
-malformed %5C'Authorization%5C' header
+no valid auth token
 '%0A  
@@ -1094,32 +1094,75 @@
 %0A      %7D else %7B%0A
+        if (typeof token !== 'string') %7B%0A  
         token = 
@@ -1171,16 +1171,26 @@
 ken%5B1%5D;%0A
+        %7D%0A
         
@@ -1536,42 +1536,27 @@
 e: '
-malformed %5C'Authorization%5C' header
+no valid auth token
 '%0A  

Update api to take auth token from query param. This is good for things like images/audio/video embeds.