@feathersjs/authentication-local 5.0.0-pre.6 → 5.0.0

package/src/hooks/hash-password.ts

@@ -1,59 +1,67 @@
-import get from 'lodash/get';
-import set from 'lodash/set';
-import cloneDeep from 'lodash/cloneDeep';
-import { BadRequest } from '@feathersjs/errors';
-import { createDebug } from '@feathersjs/commons';
-import { HookContext, NextFunction } from '@feathersjs/feathers';
-import { LocalStrategy } from '../strategy';
+import get from 'lodash/get'
+import set from 'lodash/set'
+import cloneDeep from 'lodash/cloneDeep'
+import { BadRequest } from '@feathersjs/errors'
+import { createDebug } from '@feathersjs/commons'
+import { HookContext, NextFunction } from '@feathersjs/feathers'
+import { LocalStrategy } from '../strategy'
 
-const debug = createDebug('@feathersjs/authentication-local/hooks/hash-password');
+const debug = createDebug('@feathersjs/authentication-local/hooks/hash-password')
 
 export interface HashPasswordOptions {
-  authentication?: string;
-  strategy?: string;
+  authentication?: string
+  strategy?: string
 }
 
-export default function hashPassword (field: string, options: HashPasswordOptions = {}) {
+/**
+ * @deprecated Use Feathers schema resolvers and the `passwordHash` resolver instead
+ * @param field
+ * @param options
+ * @returns
+ * @see https://dove.feathersjs.com/api/authentication/local.html#passwordhash
+ */
+export default function hashPassword(field: string, options: HashPasswordOptions = {}) {
   if (!field) {
-    throw new Error('The hashPassword hook requires a field name option');
+    throw new Error('The hashPassword hook requires a field name option')
   }
 
-  return async (context: HookContext<any, any>, next?: NextFunction) => {
-    const { app, data, params } = context;
+  return async (context: HookContext, next?: NextFunction) => {
+    const { app, data, params } = context
 
     if (data !== undefined) {
-      const authService = app.defaultAuthentication(options.authentication);
-      const { strategy = 'local' } = options;
+      const authService = app.defaultAuthentication(options.authentication)
+      const { strategy = 'local' } = options
 
       if (!authService || typeof authService.getStrategies !== 'function') {
-        throw new BadRequest('Could not find an authentication service to hash password');
+        throw new BadRequest('Could not find an authentication service to hash password')
       }
 
-      const [ localStrategy ] = authService.getStrategies(strategy) as LocalStrategy[];
+      const [localStrategy] = authService.getStrategies(strategy) as LocalStrategy[]
 
       if (!localStrategy || typeof localStrategy.hashPassword !== 'function') {
-        throw new BadRequest(`Could not find '${strategy}' strategy to hash password`);
+        throw new BadRequest(`Could not find '${strategy}' strategy to hash password`)
       }
 
       const addHashedPassword = async (data: any) => {
-        const password = get(data, field);
+        const password = get(data, field)
 
         if (password === undefined) {
-          debug(`hook.data.${field} is undefined, not hashing password`);
-          return data;
+          debug(`hook.data.${field} is undefined, not hashing password`)
+          return data
         }
 
-        const hashedPassword: string = await localStrategy.hashPassword(password, params);
+        const hashedPassword: string = await localStrategy.hashPassword(password, params)
 
-        return set(cloneDeep(data), field, hashedPassword);
+        return set(cloneDeep(data), field, hashedPassword)
       }
 
-      context.data = Array.isArray(data) ? await Promise.all(data.map(addHashedPassword)) :
-        await addHashedPassword(data);
+      context.data = Array.isArray(data)
+        ? await Promise.all(data.map(addHashedPassword))
+        : await addHashedPassword(data)
     }
 
     if (typeof next === 'function') {
-      await next();
+      return next()
     }
-  };
+  }
 }

package/src/hooks/protect.ts

@@ -1,37 +1,42 @@
-import omit from 'lodash/omit';
-import { HookContext, NextFunction } from '@feathersjs/feathers';
+import omit from 'lodash/omit'
+import { HookContext, NextFunction } from '@feathersjs/feathers'
 
-export default (...fields: string[]) => async (context: HookContext<any, any>, next?: NextFunction) => {
+/**
+ * @deprecated For reliable safe data representations use Feathers schema dispatch resolvers.
+ * @see https://dove.feathersjs.comapi/authentication/local.html#protecting-fields
+ */
+export default (...fields: string[]) => {
   const o = (current: any) => {
     if (typeof current === 'object' && !Array.isArray(current)) {
-      const data = typeof current.toJSON === 'function'
-        ? current.toJSON() : current;
+      const data = typeof current.toJSON === 'function' ? current.toJSON() : current
 
-      return omit(data, fields);
+      return omit(data, fields)
     }
 
-    return current;
-  };
-
-  if (typeof next === 'function') {
-    await next();
+    return current
   }
 
-  const result = context.dispatch || context.result;
-
-  if (result) {
-    if (Array.isArray(result)) {
-      context.dispatch = result.map(o);
-    } else if (result.data && context.method === 'find') {
-      context.dispatch = Object.assign({}, result, {
-        data: result.data.map(o)
-      });
-    } else {
-      context.dispatch = o(result);
+  return async (context: HookContext, next?: NextFunction) => {
+    if (typeof next === 'function') {
+      await next()
     }
 
-    if (context.params && context.params.provider) {
-      context.result = context.dispatch;
+    const result = context.dispatch || context.result
+
+    if (result) {
+      if (Array.isArray(result)) {
+        context.dispatch = result.map(o)
+      } else if (result.data && context.method === 'find') {
+        context.dispatch = Object.assign({}, result, {
+          data: result.data.map(o)
+        })
+      } else {
+        context.dispatch = o(result)
+      }
+
+      if (context.params && context.params.provider) {
+        context.result = context.dispatch
+      }
     }
   }
-};
+}

package/src/index.ts

@@ -1,5 +1,28 @@
-import hashPassword from './hooks/hash-password';
-import protect from './hooks/protect';
+import { HookContext } from '@feathersjs/feathers'
+import hashPassword from './hooks/hash-password'
+import protect from './hooks/protect'
+import { LocalStrategy } from './strategy'
 
-export const hooks = { hashPassword, protect };
-export { LocalStrategy } from './strategy';
+export const hooks = { hashPassword, protect }
+export { LocalStrategy }
+
+/**
+ * Returns as property resolver that hashes a given plain text password using a Local
+ * authentication strategy.
+ *
+ * @param options The authentication `service` and `strategy` name
+ * @returns
+ */
+export const passwordHash =
+  (options: { service?: string; strategy: string }) =>
+  async <H extends HookContext<any, any>>(value: string | undefined, _data: any, context: H) => {
+    if (value === undefined) {
+      return value
+    }
+
+    const { app, params } = context
+    const authService = app.defaultAuthentication(options.service)
+    const localStrategy = authService.getStrategy(options.strategy) as LocalStrategy
+
+    return localStrategy.hashPassword(value, params)
+  }

package/src/strategy.ts

@@ -1,30 +1,28 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
-import bcrypt from 'bcryptjs';
-import get from 'lodash/get';
-import omit from 'lodash/omit';
-import { NotAuthenticated } from '@feathersjs/errors';
-import { Query, Params } from '@feathersjs/feathers';
-import {
-  AuthenticationRequest, AuthenticationBaseStrategy
-} from '@feathersjs/authentication';
-import { createDebug } from '@feathersjs/commons';
-
-const debug = createDebug('@feathersjs/authentication-local/strategy');
+import bcrypt from 'bcryptjs'
+import get from 'lodash/get'
+import omit from 'lodash/omit'
+import { NotAuthenticated } from '@feathersjs/errors'
+import { Query, Params } from '@feathersjs/feathers'
+import { AuthenticationRequest, AuthenticationBaseStrategy } from '@feathersjs/authentication'
+import { createDebug } from '@feathersjs/commons'
+
+const debug = createDebug('@feathersjs/authentication-local/strategy')
 
 export class LocalStrategy extends AuthenticationBaseStrategy {
-  verifyConfiguration () {
-    const config = this.configuration;
+  verifyConfiguration() {
+    const config = this.configuration
 
-    [ 'usernameField', 'passwordField' ].forEach(prop => {
+    ;['usernameField', 'passwordField'].forEach((prop) => {
       if (typeof config[prop] !== 'string') {
-        throw new Error(`'${this.name}' authentication strategy requires a '${prop}' setting`);
+        throw new Error(`'${this.name}' authentication strategy requires a '${prop}' setting`)
       }
-    });
+    })
   }
 
-  get configuration () {
-    const authConfig = this.authentication.configuration;
-    const config = super.configuration || {};
+  get configuration() {
+    const authConfig = this.authentication.configuration
+    const config = super.configuration || {}
 
     return {
       hashSize: 10,
@@ -35,100 +33,110 @@ export class LocalStrategy extends AuthenticationBaseStrategy {
       entityPasswordField: config.passwordField,
       entityUsernameField: config.usernameField,
       ...config
-    };
+    }
   }
 
-  async getEntityQuery (query: Query, _params: Params) {
+  async getEntityQuery(query: Query, _params: Params) {
     return {
       $limit: 1,
       ...query
-    };
+    }
   }
 
-  async findEntity (username: string, params: Params) {
-    const { entityUsernameField, errorMessage } = this.configuration;
-    if (!username) { // don't query for users without any condition set.
-      throw new NotAuthenticated(errorMessage);
+  async findEntity(username: string, params: Params) {
+    const { entityUsernameField, errorMessage } = this.configuration
+    if (!username) {
+      // don't query for users without any condition set.
+      throw new NotAuthenticated(errorMessage)
     }
 
-    const query = await this.getEntityQuery({
-      [entityUsernameField]: username
-    }, params);
+    const query = await this.getEntityQuery(
+      {
+        [entityUsernameField]: username
+      },
+      params
+    )
 
-    const findParams = Object.assign({}, params, { query });
-    const entityService = this.entityService;
+    const findParams = Object.assign({}, params, { query })
+    const entityService = this.entityService
 
-    debug('Finding entity with query', params.query);
+    debug('Finding entity with query', params.query)
 
-    const result = await entityService.find(findParams);
-    const list = Array.isArray(result) ? result : result.data;
+    const result = await entityService.find(findParams)
+    const list = Array.isArray(result) ? result : result.data
 
     if (!Array.isArray(list) || list.length === 0) {
-      debug('No entity found');
+      debug('No entity found')
 
-      throw new NotAuthenticated(errorMessage);
+      throw new NotAuthenticated(errorMessage)
     }
 
-    const [ entity ] = list;
+    const [entity] = list
 
-    return entity;
+    return entity
   }
 
-  async getEntity (result: any, params: Params) {
-    const entityService = this.entityService;
-    const { entityId = (entityService as any).id, entity } = this.configuration;
+  async getEntity(result: any, params: Params) {
+    const entityService = this.entityService
+    const { entityId = (entityService as any).id, entity } = this.configuration
 
     if (!entityId || result[entityId] === undefined) {
-      throw new NotAuthenticated('Could not get local entity');
+      throw new NotAuthenticated('Could not get local entity')
     }
 
     if (!params.provider) {
-      return result;
+      return result
     }
 
     return entityService.get(result[entityId], {
       ...params,
       [entity]: result
-    });
+    })
   }
 
-  async comparePassword (entity: any, password: string) {
-    const { entityPasswordField, errorMessage } = this.configuration;
+  async comparePassword(entity: any, password: string) {
+    const { entityPasswordField, errorMessage } = this.configuration
     // find password in entity, this allows for dot notation
-    const hash = get(entity, entityPasswordField);
+    const hash = get(entity, entityPasswordField)
 
     if (!hash) {
-      debug(`Record is missing the '${entityPasswordField}' password field`);
+      debug(`Record is missing the '${entityPasswordField}' password field`)
 
-      throw new NotAuthenticated(errorMessage);
+      throw new NotAuthenticated(errorMessage)
     }
 
-    debug('Verifying password');
+    debug('Verifying password')
 
-    const result = await bcrypt.compare(password, hash);
+    const result = await bcrypt.compare(password, hash)
 
     if (result) {
-      return entity;
+      return entity
     }
 
-    throw new NotAuthenticated(errorMessage);
+    throw new NotAuthenticated(errorMessage)
   }
 
-  async hashPassword (password: string, _params: Params) {
-    return bcrypt.hash(password, this.configuration.hashSize);
+  async hashPassword(password: string, _params: Params) {
+    return bcrypt.hash(password, this.configuration.hashSize)
   }
 
-  async authenticate (data: AuthenticationRequest, params: Params) {
-    const { passwordField, usernameField, entity } = this.configuration;
-    const username = data[usernameField];
-    const password = data[passwordField];
-    const result = await this.findEntity(username, omit(params, 'provider'));
+  async authenticate(data: AuthenticationRequest, params: Params) {
+    const { passwordField, usernameField, entity, errorMessage } = this.configuration
+    const username = data[usernameField]
+    const password = data[passwordField]
 
-    await this.comparePassword(result, password);
+    if (!password) {
+      // exit early if there is no password
+      throw new NotAuthenticated(errorMessage)
+    }
+
+    const result = await this.findEntity(username, omit(params, 'provider'))
+
+    await this.comparePassword(result, password)
 
     return {
       authentication: { strategy: this.name },
       [entity]: await this.getEntity(result, params)
-    };
+    }
   }
 }