@go-mailer/jarvis 10.5.1 → 10.6.0

package/lib/clients/iam.js

@@ -32,6 +32,28 @@ const fetchTenants = async (query = '') => {
   return { tenants, size: meta?.size || 0 }
 }
 
+const refreshToken = async (data = {}, query = '', tries = 0) => {
+  try {
+    const { data: response } = await axios.post(
+      `${IAM_URI}/guests/token/refresh?${query}`,
+      { ...data },
+      {
+        headers: {
+          authorization: `Bearer ${DEFAULT_TOKEN}`
+        }
+      }
+    )
+
+    const { error, payload } = response
+    if (error) throw new Error(error)
+
+    return payload
+  } catch (e) {
+    if (tries < 3) return await refreshToken(data, query, tries + 1)
+    return null
+  }
+}
+
 const verifyAPIKey = async (key) => {
   const { error, payload } = (
     await axios.get(`${API_SERVICE_URI}/keys/verify/${key}`, {
@@ -68,4 +90,4 @@ const verifyFeatureFlag = async (flag_name, criteria = {}) => {
   return payload.is_permitted
 }
 
-module.exports = { checkAuthority, fetchTenants, verifyAPIKey, verifyFeatureFlag }
+module.exports = { checkAuthority, fetchTenants, refreshToken, verifyAPIKey, verifyFeatureFlag }

package/lib/middlewares/auth.js

@@ -10,8 +10,7 @@ const geoip = require('geoip-lite')
 const Env = require('../env')
 const Errors = require('./errors')
 const { ProcessLogger } = require('./logger')
-const { checkAuthority, verifyAPIKey } = require('../clients/iam')
-const { localCache } = require('../redis/cache')
+const { verifyAPIKey } = require('../clients/iam')
 const authLogger = new ProcessLogger('Authenticator')
 
 // helpers
@@ -98,10 +97,18 @@ const authenticateUser = async (request, response, next) => {
       return next()
     }
 
-    const { id: user_id, is_admin, tenant_id } = await jwt.verify(token, SECRET, { issuer: ISSUER })
+    const {
+      id: user_id,
+      is_admin,
+      tenant_id,
+      permissions,
+      permission_expires_at
+    } = await jwt.verify(token, SECRET, { issuer: ISSUER })
     request.is_admin = !!is_admin
     request.user_id = is_admin ? extractId(request, 'user_id') : user_id
     request.tenant_id = is_admin ? extractId(request, 'tenant_id') : tenant_id
+    request.permissions = permissions
+    request.permission_expires_at = permission_expires_at
 
     next()
   } catch (e) {
@@ -113,15 +120,17 @@ const authenticateUser = async (request, response, next) => {
 const authorizeUser = ({ action, resource }) => {
   return async (request, response, next) => {
     try {
-      const { is_admin, is_service_request, tenant_id, user_id } = request
+      const { is_admin, is_service_request, permissions, permission_expires_at } = request
       if (is_admin || is_service_request) return next()
 
-      const key = `${resource}:${action}:${tenant_id}:${user_id}`
-      const has_authority = localCache.get_item(key)
-      if (has_authority == null) {
-        const is_permitted = await checkAuthority({ action, resource, tenant_id, user_id })
-        localCache.add_item(key, is_permitted, 15 * 60)
-      } else if (has_authority === false) {
+      if (!permissions || !permission_expires_at) throw new Error('Unauthorized')
+      if (Date.now() > permission_expires_at) {
+        throw new Error('')
+      }
+
+      const is_superadmin = Object.keys(permissions)[0].includes('*')
+      const is_permitted = permissions[`${resource}:${action}`]
+      if (!is_superadmin && !is_permitted) {
         throw new Error('Unauthorized')
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-mailer/jarvis",
-  "version": "10.5.1",
+  "version": "10.6.0",
   "main": "index.js",
   "repository": "git@github.com:go-mailer-ltd/jarvis-node.git",
   "author": "Nathan Oguntuberu <nateoguns.work@gmail.com>",