transactions-express-passport/lib/jwt.js

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.getIsJwtAuthorization = getIsJwtAuthorization;
exports.hasJwtApiAccess = hasJwtApiAccess;
exports.useJwt = useJwt;

var _jsonwebtoken = require('jsonwebtoken');

var _jsonwebtoken2 = _interopRequireDefault(_jsonwebtoken);

var _passport = require('passport');

var _passport2 = _interopRequireDefault(_passport);

var _passportJwt = require('passport-jwt');

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

var DEFAULT_EXPIRY_TIME = 1000 * 60 * 60; // 1h

function getIsJwtAuthorization(authorization) {
  return (/JWT (.*)/.test(authorization)
  );
}

function hasJwtApiAccess(req, res, next) {
  var config = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : {};

  // unpack
  var conditions = req.conditions,
      logger = req.logger;
  // escape

  if (conditions) {
    if (conditions.every(function (_ref) {
      var subscribedMode = _ref.subscribedMode;
      return subscribedMode.isSkipJwt;
    })) {
      next();
      return true;
    }
  }
  // special jwt check
  if (!req.headers || !req.headers.authorization || !getIsJwtAuthorization(req.headers.authorization)) {
    logger.warn('Wrong format of your authorization header');
    res.status(401).json({
      error: 'Wrong format of your authorization header',
      errorCode: 'INVALID_AUTHORIZATION_HEADER'
    });
    return false;
  }
  _passport2.default.authenticate('jwt', { session: false }, function (err, user, info) {
    if (err) {
      logger.warn('error authenticating user', err);
      res.status(400).json({
        error: 'Unexpected error validating your auth token',
        errorCode: 'INVALID_JWT_TOKEN'
      });
      return false;
    }
    if (!user) {
      logger.warn('JWT didnt match any user (invalid?)', info);
      res.status(401).json({
        error: 'Auth token invalid or expired',
        errorCode: 'INVALID_JWT_TOKEN'
      });
      return false;
    }
    req.user = user;
    next();
  })(req, res, next);
}

function useJwt(app, config) {
  // unpack
  var db = config.db,
      jwtSecret = config.jwtSecret,
      localAuthenticate = config.localAuthenticate,
      routePath = config.routePath;

  var usersCollection = db.collection('users');

  // JWT creator
  function createJWTforUser(user) {
    var expiry = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : Date.now() + DEFAULT_EXPIRY_TIME;

    if (!user) {
      return null;
    }
    return {
      token: _jsonwebtoken2.default.sign({
        // we only need to keep the fields necessary to asses privilege level
        user: {
          id: user.id,
          email: user.email,
          active: user.active,
          admin: user.admin
        },
        // jwt uses seconds, not ms
        exp: Math.round(expiry / 1000)
      }, jwtSecret),
      expiry: expiry
    };
  }
  // strategy
  var localJwtStrategy = new _passportJwt.Strategy({
    jwtFromRequest: _passportJwt.ExtractJwt.fromAuthHeader(),
    secretOrKey: jwtSecret
  }, function (jwtPayload, next) {
    next(null, jwtPayload.user);
    return;
  });
  // use
  _passport2.default.use(localJwtStrategy);
  // api auth token
  var jwtAuthenticate = function jwtAuthenticate(req, res, next) {
    var user = req.user;
    var _req$body = req.body,
        email = _req$body.email,
        isJwtNext = _req$body.isJwtNext;

    if (!user) {
      res.status(401).json({ error: 'You need to be logged in.' });
      return;
    }
    if (!email) {
      return res.status(400).json({
        error: 'Email required'
      });
    }
    // NOTE: assumption that user used local sign up
    usersCollection.findOne({ 'local.email': email }).then(function (matchedUser) {
      if (!matchedUser) {
        return res.status(400).json({
          error: 'No authorised user'
        });
      }

      var _createJWTforUser = createJWTforUser({
        active: matchedUser.active,
        admin: matchedUser.admin,
        id: matchedUser.id,
        email: email
      }),
          token = _createJWTforUser.token,
          expiry = _createJWTforUser.expiry;

      var json = {
        authToken: token,
        authTokenExpiry: expiry
      };
      if (isJwtNext) {
        // Object.assign(req.body, json)
        req.headers.authorization = 'JWT ' + token;
        next();
      } else {
        res.json(json);
      }
      return;
    });
  };
  // apis
  // NOTE: authenticate api we rely on having req.user available here,
  // to only grant new auth token if the posted email belongs to the logged in user.
  // This means we can currently not renew api auth tokens outside of the specific domain
  // this server lives on.
  app.post(routePath + '/authenticate', jwtAuthenticate);
  // token api needs to have email and password credentials
  if (localAuthenticate) {
    app.post(routePath + '/token', localAuthenticate, function (req, res, next) {
      if (req.user) {
        next();
      } else {
        res.json({ error: 'not a valid user' });
      }
    }, jwtAuthenticate);
  }
  return { createJWTforUser: createJWTforUser,
    jwtAuthenticate: jwtAuthenticate
  };
}