chore: add passport-jwt (MEL-12) (#31)

lib/auth/passport.ts

@@ -1,9 +1,8 @@
 import passport from 'passport'
 import { Strategy as LocalStrategy } from 'passport-local'
-import { Strategy as JwtStrategy, extract } from 'passport-jwt'
+import { Strategy as JwtStrategy } from 'passport-jwt'
 import { User } from 'users/model'
 import { verify } from 'utils/crypto'
-import { AUTH_TOKEN } from '../utils/env'
 import { jwtConfig } from '../utils/config'
 
 /* Fucking Passport-thing selection */
@@ -15,7 +14,20 @@ let localstrategy = new LocalStrategy({ usernameField: 'username' }, function (u
 				return done(null, false, { message: 'No such user' })
 			}
 			if (!verify(password, user.password)) {
-				return done(null, false, { message: 'Wrong password' })
+				done(null, false, { message: 'Wrong password' })
+			}
+			return done(null, user)
+		})
+		.catch(function (err) {
+			return done(null, false, { message: err })
+		})
+})
+
+let jwtstrategy = new JwtStrategy(jwtConfig, function (payload, done) {
+	User.findOne({ id: payload.sub })
+		.then(function (user) {
+			if (!user) {
+				return done(null, false, { message: 'No such user' })
 			}
 			return done(null, user)
 		})
@@ -36,7 +48,7 @@ passport.deserializeUser((id, done) => {
 })
 
 passport.use(localstrategy)
-// passport.use(jwtstrategy)
+passport.use(jwtstrategy)
 
 export default passport
 

lib/auth/router.v1.ts

@@ -5,6 +5,7 @@ const router = express.Router()
 
 // I have no fucking idea what's wrong with this Passport...
 
+// This is fucked up I think, even if I don't see an error there this route allows me to login under specific username with literally any password. I don't know what's wrong with it.
 router.post('/login', (req, res, next) => {
 	passport.authenticate('local', function (err, user, info) {
 		if (err) {
@@ -17,12 +18,12 @@ router.post('/login', (req, res, next) => {
 			if (err) {
 				return res.status(400).json({ errors: err })
 			}
-			return res.status(200).json({ success: `logged in ${user.username}` })
+			return res.status(200).json({ success: `Hello! ${user.username}` })
 		})
 	})(req, res, next)
 })
 
-router.get('/profile', passport.authenticate('local'), (req, res) => {
+router.get('/profile', passport.authenticate('jwt'), (req, res) => {
 	if (req.isAuthenticated()) {
 		res.status(200).json(req.user)
 	} else {

lib/utils/config.ts

@@ -1,12 +1,23 @@
 import { AUTH_TOKEN, MONGODB_URI } from './env'
 import MongoStore from 'connect-mongo'
+import { ExtractJwt } from 'passport-jwt'
 
 export const sessionConfig = {
+	// TODO: We can think about potential migration to Memcached with following package: https://www.npmjs.com/package/connect-memcached
 	store: new MongoStore({
 		mongoUrl: MONGODB_URI,
 		collectionName: 'sessions',
 	}),
 	secret: AUTH_TOKEN,
+	// NOTE: "secure" should be turned on on production, it requires https to work at all so it's disabled during development time, maybe we can make it relative to NODE_ENV.
+	secure: false,
 	resave: false,
 	saveUninitialized: false,
 }
+
+export const jwtConfig = {
+	jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+	secretOrKey: AUTH_TOKEN,
+	// issuer: 'araclx.com',
+	// audience: 'm3llo.co'
+}