minimum attempt to protect /api/v2/ endpoints (nightscout#7554)

* minimum attempt to protect /api/v2/ endpoints

These endpoints should be protected as reported in
nightscout#7546.

* remove spurious line

Co-authored-by: Sulka Haro <[email protected]>

Author: bewest

lib/api/properties.js

@@ -18,6 +18,8 @@ function create (env, ctx) {
    *
    * Expecting to define extended syntax and support for several query params
    */
+  properties.use(ctx.authorization.isPermitted('api:entries:read'),
+    ctx.authorization.isPermitted('api:treatments:read'));
   properties.get(['/', '/*'], function getProperties (req, res) {
 
     var sbx = sandbox.serverInit(env, ctx);
@@ -57,4 +59,4 @@ function create (env, ctx) {
   return properties;
 }
 
-module.exports = create;
+module.exports = create;

lib/data/endpoints.js

@@ -64,6 +64,8 @@ function configure (app, ctx) {
     next( );
   });
 
+  api.use(ctx.authorization.isPermitted('api:entries:read'),
+    ctx.authorization.isPermitted('api:treatments:read'));
   api.get('/at/:at?', ensure_at, get_ddata, format_result);
 
   return api;