Add a config option to disable authentication in order to allow anybody...

heimcontrol.js

@@ -139,25 +139,28 @@ requirejs([ 'http', 'connect', 'mongodb', 'path', 'express', 'node-conf', 'socke
       });
 
       // Routes
+      var isAuthorizedRoute = config.authentication == "false" ?
+	Routes.noAuthentication : Routes.isAuthorized;
+
       app.get('/register', Routes.showRegister);
       app.post('/register', Routes.doRegister);
 
       app.get('/login', Routes.showLogin);
       app.post('/login', Routes.doLogin);
       app.post('/api/login', Routes.createAuthToken);
 
-      app.get('/', Routes.isAuthorized, Routes.index);
+      app.get('/', isAuthorizedRoute, Routes.index);
 
-      app.get('/settings', Routes.isAuthorized, Routes.settings);
-      app.post('/settings/password', Routes.isAuthorized, Routes.changePassword);
-      app.post('/settings/user/create', Routes.isAuthorized, Routes.createUser);
-      app.get('/settings/user/delete/:email', Routes.isAuthorized, Routes.deleteUser);
-      app.post('/settings/theme', Routes.isAuthorized, Routes.changeTheme);
+      app.get('/settings', isAuthorizedRoute, Routes.settings);
+      app.post('/settings/password', isAuthorizedRoute, Routes.changePassword);
+      app.post('/settings/user/create', isAuthorizedRoute, Routes.createUser);
+      app.get('/settings/user/delete/:email', isAuthorizedRoute, Routes.deleteUser);
+      app.post('/settings/theme', isAuthorizedRoute, Routes.changeTheme);
 
-      app.all('/api/:plugin/:method?', Routes.isAuthorized, Routes.api, Routes.notFound);
+      app.all('/api/:plugin/:method?', isAuthorizedRoute, Routes.api, Routes.notFound);
 
-      app.get('/settings/:plugin', Routes.isAuthorized, Routes.settings, Routes.notFound);
-      app.post('/settings/:plugin', Routes.isAuthorized, Routes.saveSettings, Routes.notFound);
+      app.get('/settings/:plugin', isAuthorizedRoute, Routes.settings, Routes.notFound);
+      app.post('/settings/:plugin', isAuthorizedRoute, Routes.saveSettings, Routes.notFound);
 
       app.get('/logout', Routes.logout);
 

routes/index.js

@@ -758,6 +758,18 @@ define([ 'crypto', 'cookie', 'fs' ], function(crypto, cookie, fs) {
     }
   };
 
+  /**
+   * Don't do any authorization check.
+   *
+   * @method noAuthentication 
+   * @param {Object} req The request
+   * @param {Object} res The response
+   * @param {Object} next The next route
+   */
+  Controller.noAuthentication = function(req, res, next) {
+    next();
+  };
+
   var exports = Controller;
 
   return exports;