Pass API execution context to sandbox

Closes: #114
PR-URL: #112

Author: tshemsedinov

lib/application.js

@@ -34,7 +34,8 @@ class Application extends events.EventEmitter {
 
   createSandbox() {
     const introspection = async () => [...this.api.keys()];
-    const application = { security, api: { introspection } };
+    const context = Object.freeze({});
+    const application = { security, api: { introspection }, context };
     for (const name of this.namespaces) application[name] = this[name];
     const sandbox = { console: this.logger, application, Buffer, api };
     sandbox.global = sandbox;
@@ -51,7 +52,7 @@ class Application extends events.EventEmitter {
     const data = await fsp.readFile(fileName, 'utf8');
     const code = data.startsWith('({') ? data :
       `({ access: 'logged', method: ${data.trim().slice(0, -1)} });`;
-    const src = `'use strict';\ncontext => ${code}`;
+    const src = `'use strict';\n${code}`;
     const options = { filename: fileName, lineOffset: -1 };
     try {
       return new vm.Script(src, options);
@@ -61,7 +62,8 @@ class Application extends events.EventEmitter {
     }
   }
 
-  runScript(methodName, sandbox = this.sandbox) {
+  runScript(methodName, session) {
+    const sandbox = session ? session.sandbox : this.sandbox;
     const script = this.api.get(methodName);
     if (!script) return null;
     return script.runInContext(sandbox, SCRIPT_OPTIONS);

lib/auth.js

@@ -90,7 +90,7 @@ module.exports = application => {
       this.token = token;
       this.sandbox = sandbox;
       this.data = contextData;
-      this.context = new Proxy(contextData, contextHandler);
+      sandbox.context = new Proxy(contextData, contextHandler);
     }
   }
 

lib/server.js

@@ -92,14 +92,11 @@ class Client {
     }
     try {
       const session = await application.auth.restore(this);
-      const sandbox = session ? session.sandbox : undefined;
-      const context = session ? session.context : {};
-      const exp = application.runScript(method, sandbox);
-      if (!exp) {
+      const proc = application.runScript(method, session);
+      if (!proc) {
         this.error(404);
         return;
       }
-      const proc = exp(context);
       if (!session && proc.access !== 'public') {
         this.error(403, new Error(`Forbidden: /api/${method}`));
         return;