sparkles: Added JWT stateless authentication

packages/backend/src/config/index.js

@@ -8,7 +8,7 @@ export default {
   jwt: {
     secretOrKey: process.env.MONGO_ENC_KEY,
     issuer: process.env.JWT_ISSUER,
-    audience: process.env.JWT_SITE,
+    audience: process.env.JWT_ISSUER,
     expiresIn: "36 days",
 
   },

packages/backend/src/controllers/user.js

@@ -5,10 +5,9 @@ import { log } from "../utils";
 import jwt from "jsonwebtoken";
 import config from "../config";
 
-const userController = {};
+function UserController() { }
 
-// Login
+UserController.prototype.login = function (req, res) {
-userController.login = (req, res) => {
   if (!req.body) return res.sendStatus(400);
   User.findOne({
     $or: [
@@ -25,7 +24,9 @@ userController.login = (req, res) => {
         let account = user.account();
         let token = jwt.sign({
           _id: account._id,
-          handle: account.handle
+          handle: account.handle,
+          aud: config.jwt.audience,
+          iss: config.jwt.issuer,
         }, config.jwt.secretOrKey);
         user.updateLoginTime(() => res.send({account,token}));
       } else {
@@ -36,40 +37,40 @@ userController.login = (req, res) => {
   });
 }
 
+
 // CRUD basics
-userController.create = (req, res) => { }
-userController.readAccount = (req, res) => { }
-userController.readOwnProfile = (req, res) => { }
-userController.readProfile = (req, res) => { }
-userController.update = (req, res) => { }
-userController.delete = (req, res) => { }
 
-// Signup flow
+//  create (req, res) { }
-userController.signup = (req, res) => { }
+UserController.prototype.readAccount = function (req, res) {
-userController.confirmSignupEmail = (req, res) => { }
+  if (!req.user._id) return res.sendStatus(400);
-userController.removeConfirmation = (req, res) => { }
+  User.findById(req.user._id, (err, user) => {
-userController.resendActivationEmail = (req, res) => { }
+    log.info('ping', { user, req });
-
+    res.send({account: user.account()});
-// Reset/recover/change email
-userController.recoverPassword = (req, res) => { }
-userController.resetPassword = (req, res) => { }
-userController.confirmChangedEmail = (req, res) => { }
-
-// Other
-userController.patronList = (req, res) => { }
-userController.exportData = (req, res) => { }
-
-
-userController.findOne = (req, res) => {
-  User.find({"username":"joost"})
-  .then( users => {
-    res.send(users);
-  }).catch(err => {
-    res.status(500).send({
-      message: err.message || "An error occurred."
-    });
   });
 }
+//  readAccount (req, res) {
+//    //console.log('test', req);
+//    return res.sendStatus(200);//(req.user);
+//  }
+ // userController.readOwnProfile = (req, res) => { }
+ // userController.readProfile = (req, res) => { }
+ // userController.update = (req, res) => { }
+ // userController.delete = (req, res) => { }
+
+ // // Signup flow
+ // userController.signup = (req, res) => { }
+ // userController.confirmSignupEmail = (req, res) => { }
+ // userController.removeConfirmation = (req, res) => { }
+ // userController.resendActivationEmail = (req, res) => { }
+
+ // // Reset/recover/change email
+ // userController.recoverPassword = (req, res) => { }
+ // userController.resetPassword = (req, res) => { }
+ // userController.confirmChangedEmail = (req, res) => { }
+
+ // // Other
+ // userController.patronList = (req, res) => { }
+ // userController.exportData = (req, res) => { }
 
 
 const clean = (email) => email.toLowerCase().trim();
@@ -86,4 +87,4 @@ const passwordMatches = async (password, hash) => {
   return match;
 }
 
-export default userController;
+export default UserController;

packages/backend/src/index.js

@@ -1,17 +1,22 @@
 import express from "express";
 import mongoose from "mongoose";
 import chalk from "chalk";
+import passport from "passport";
 import config from "./config";
-import middleware from "./middleware";
+import expressMiddleware from "./middleware/express";
+import passportMiddleware from "./middleware/passport";
 import routes from "./routes";
 
 const app = express();
 
-// Load middleware
+// Load Express middleware
-for (let type of Object.keys(middleware)) middleware[type](app);
+for (let type of Object.keys(expressMiddleware)) expressMiddleware[type](app);
+
+// Load Passport middleware
+for (let type of Object.keys(passportMiddleware)) passportMiddleware[type](passport);
 
 // Load routes
-for (let type of Object.keys(routes)) routes[type](app);
+for (let type of Object.keys(routes)) routes[type](app, passport);
 
 // Connecting to the database
 mongoose.Promise = global.Promise;
@@ -45,7 +50,7 @@ const port = process.env.PORT || 3000;
 
 app.listen(port, err => {
   if (err) {
-    console.error(err);
+    console.error('Error occured', err);
   }
 
   if (__DEV__) {

packages/backend/src/middleware/passport.js

@@ -1,11 +0,0 @@
-import jwt from "passport-jwt";
-import config from "../config";
-
-const options = {
-  jwtFromRequest: jwt.ExtractJwt.fromAuthHeaderAsBearerToken(),
-  ...config.jwt
-}
-
-export default (app) => {
-  app.use(new jwt.Strategy(options));
-}

packages/backend/src/middleware/passport/index.js

@@ -0,0 +1,3 @@
+import jwt from "./jwt";
+
+export default { jwt }

packages/backend/src/middleware/passport/jwt.js

@@ -0,0 +1,13 @@
+import jwt from "passport-jwt";
+import config from "../../config";
+
+const options = {
+  jwtFromRequest: jwt.ExtractJwt.fromAuthHeaderAsBearerToken(),
+  ...config.jwt
+}
+
+export default (passport) => {
+  passport.use(new jwt.Strategy(options, (jwt_payload, done) => {
+    return done(null, jwt_payload);
+  }));
+}

packages/backend/src/routes/user.js

@@ -1,7 +1,9 @@
-import userController from "../controllers/user";
+import Controller from "../controllers/user";
 
-export default (app) => {
+const User = new Controller();
-  app.get('/user', userController.findOne);
+
+export default (app, passport) => {
+  //app.get('/user', userController.findOne);
 
 /**********************************************
  *                                            *
@@ -12,43 +14,43 @@ export default (app) => {
   /*  Sign-up flow */
 
   // Sign up user
-  app.post('/signup', userController.signup);
+  //app.post('/signup', userController.signup);
 
   // Resend user activation email
-  app.post('/resend/activation/email', userController.resendActivationEmail);
+  //app.post('/resend/activation/email', userController.resendActivationEmail);
 
   // Create account from confirmation / Consent for data processing given
-  app.post('/user', userController.create);
+  //app.post('/user', userController.create);
 
   // Remove confirmation / No consent for data processing given
-  app.delete('/remove/confirmation/:token', userController.removeConfirmation);
+  //app.delete('/remove/confirmation/:token', userController.removeConfirmation);
 
 
   /* Login flow */
 
   // User login
-  app.post('/login', userController.login);
+  app.post('/login', User.login);
 
   // Recover user password
-  app.post('/recover/password', userController.recoverPassword);
+  //app.post('/recover/password', userController.recoverPassword);
 
   // Reset user password
-  app.post('/reset/password', userController.resetPassword);
+  //app.post('/reset/password', userController.resetPassword);
 
 
   /* Email confirmation endpoints */
   // (these are always GET because they are links in an email)
 
   // Confirm email address at signup
-  app.get('/confirm/signup/email/:token', userController.confirmSignupEmail);
+  //app.get('/confirm/signup/email/:token', userController.confirmSignupEmail);
 
   // Confirm user email change
-  app.get('/confirm/changed/email:handle/:token', userController.confirmChangedEmail);
+  //app.get('/confirm/changed/email:handle/:token', userController.confirmChangedEmail);
 
 
   /* Email confirmation endpoints */
   // Load patron list
-  app.get('/patrons/list', userController.patronList);
+  //app.get('/patrons/list', userController.patronList);
 
 
 /**********************************************
@@ -58,17 +60,22 @@ export default (app) => {
  *********************************************/
 
   /* CRUD endpoints */
-  app.get('/account', userController.readAccount); // Read account (own data)
+  app.get('/account', passport.authenticate('jwt', { session: false }), User.readAccount); // Read account (own data)
-  app.get('/user', userController.readOwnProfile); // Read profile (own data)
+  //app.get('/account', function(req, res,next) {
-  app.get('/user/:handle', userController.readProfile); // Read profile (other user's data)
+  //    passport.authenticate('jwt', function(err, user, info) {
+  //      console.log('In authenticate callback, arguments should be (err, user, info)', arguments);
+  //      return next(res.send({error: err, user: user, info: info}));
+  //    })(req, res, next)
+  //});
+
+  //app.get('/user', userController.readOwnProfile); // Read profile (own data)
+  //app.get('/user/:handle', userController.readProfile); // Read profile (other user's data)
   // Create is a non-authenticated route part of sign-up flow
-  app.put('/user', userController.update); // Update
+  //app.put('/user', userController.update); // Update
-  app.delete('/user', userController.delete); // Delete
+  //app.delete('/user', userController.delete); // Delete
-
-
 
   // Export data
-  app.get('/export', userController.exportData);
+  //app.get('/export', userController.exportData);
 }
 
 

packages/backend/src/utils/log/index.js

@@ -7,6 +7,7 @@ const now = () => dateFormat(new Date(), "yyyy-mm-dd hh:MM:ss");
 const logWorthy = (msg, data) => {
   let d = {at: now()};
   switch(msg) {
+    case 'ping':
     case 'login':
     case 'wrongPassword':
       d.user = data.user.handle;