transactions-express-passport/lib/jwt.js

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.hasSubscribedApiAccess = hasSubscribedApiAccess;
exports.useJwt = useJwt;

var _jsonwebtoken = require('jsonwebtoken');

var _jsonwebtoken2 = _interopRequireDefault(_jsonwebtoken);

var _passport = require('passport');

var _passport2 = _interopRequireDefault(_passport);

var _passportJwt = require('passport-jwt');

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

var DEFAULT_EXPIRY_TIME = 1000 * 60 * 60; // 1h

function hasSubscribedApiAccess(scope, req, res, next, logger) {
  _passport2.default.authenticate('jwt', { session: false }, function (err, user, info) {
    if (err) {
      logger.warn('error authenticating user', err);
      return res.status(400).json({
        error: 'Unexpected error validating your auth token',
        errorCode: 'INVALID_JWT_TOKEN'
      });
    }
    if (!user) {
      logger.warn('JWT didnt match any user (invalid?)', info);
      return res.status(401).json({
        error: 'Auth token invalid or expired',
        errorCode: 'INVALID_JWT_TOKEN'
      });
    }
    if (scope === 'admin') {
      if (!user.admin) {
        logger.warn('requested admin scope, but user was not admin:', user);
        return res.status(401).json({
          error: 'Requires additional privileges'
        });
      }
      if (!user.active) {
        logger.warn('requested active scope, but user was not active:', user);
        return res.status(401).json({
          error: 'Requires additional privileges'
        });
      }
    }
    if (scope === 'active') {
      if (!user.active) {
        logger.warn('requested active scope, but user was not active:', user);
        return res.status(401).json({
          error: 'Requires additional privileges'
        });
      }
    }
    req.user = user;
    next();
  })(req, res, next);
}

function useJwt(app, config) {
  // unpack
  var db = config.db,
      jwtSecret = config.jwtSecret,
      localAuthenticate = config.localAuthenticate,
      routePath = config.routePath;

  var usersCollection = db.collection('users');

  // JWT creator
  function createJWTforUser(user) {
    var expiry = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : Date.now() + DEFAULT_EXPIRY_TIME;

    if (!user) {
      return null;
    }
    return {
      token: _jsonwebtoken2.default.sign({
        // we only need to keep the fields necessary to asses privilege level
        user: {
          id: user.id,
          email: user.email,
          active: user.active,
          admin: user.admin
        },
        // jwt uses seconds, not ms
        exp: Math.round(expiry / 1000)
      }, jwtSecret),
      expiry: expiry
    };
  }
  // strategy
  var localJwtStrategy = new _passportJwt.Strategy({
    jwtFromRequest: _passportJwt.ExtractJwt.fromAuthHeader(),
    secretOrKey: jwtSecret
  }, function (jwtPayload, next) {
    next(null, jwtPayload.user);
    return;
  });
  // use
  _passport2.default.use(localJwtStrategy);
  // api auth token
  var jwtAuthenticate = function jwtAuthenticate(req, res, next) {
    var user = req.user;
    var _req$body = req.body,
        email = _req$body.email,
        isJwtNext = _req$body.isJwtNext;

    if (!user) {
      res.status(401).json({ error: 'You need to be logged in.' });
      return;
    }
    if (!email) {
      return res.status(400).json({
        error: 'Email required'
      });
    }
    // NOTE: assumption that user used local sign up
    usersCollection.findOne({ 'local.email': email }).then(function (matchedUser) {
      if (!matchedUser) {
        return res.status(400).json({
          error: 'No authorised user'
        });
      }

      var _createJWTforUser = createJWTforUser({
        active: matchedUser.active,
        admin: matchedUser.admin,
        id: matchedUser.id,
        email: email
      }),
          token = _createJWTforUser.token,
          expiry = _createJWTforUser.expiry;

      var json = {
        authToken: token,
        authTokenExpiry: expiry
      };
      if (isJwtNext) {
        // Object.assign(req.body, json)
        req.headers.authorization = 'JWT ' + token;
        next();
      } else {
        res.json(json);
      }
      return;
    });
  };
  // apis
  // NOTE: authenticate api we rely on having req.user available here,
  // to only grant new auth token if the posted email belongs to the logged in user.
  // This means we can currently not renew api auth tokens outside of the specific domain
  // this server lives on.
  app.post(routePath + '/authenticate', jwtAuthenticate);
  // token api needs to have email and password credentials
  if (localAuthenticate) {
    app.post(routePath + '/token', localAuthenticate, function (req, res, next) {
      if (req.user) {
        console.log('req.body', req.body);
        next();
      } else {
        res.json({ error: 'not a valid user' });
      }
    }, jwtAuthenticate);
  }
  return { createJWTforUser: createJWTforUser,
    jwtAuthenticate: jwtAuthenticate
  };
}