@go-mailer/jarvis 4.2.5 → 5.0.1

package/lib/middlewares/auth.js

@@ -2,89 +2,117 @@
  * User Authentication Middleware
  */
 
-const jwt = require("jsonwebtoken");
-const Env = require("../env");
-const Errors = require("./errors");
-const { ProcessLogger } = require("./logger");
-const { verifyAPIKey } = require("../clients/iam");
-const authLogger = new ProcessLogger("Authenticator");
-
-// helpers
-const extract_token = (headers) => {
-  const { authorization } = headers;
-  if (!authorization) throw new Error("Unauthorized");
-
-  const [, token] = authorization.split(" ");
-  if (!token) throw new Error("Unauthorized");
-
-  return token;
-};
-
-const extract_tenant_id = (request) => {
-  const { params, query } = request;
-  let tenant_id = { $exists: true };
-  if (query.tenant_id) tenant_id = query.tenant_id;
-  if (params.tenant_id) tenant_id = params.tenant_id;
-
-  return tenant_id;
-};
-
-// main
-
-const authenticateAdmin = async (request, response, next) => {
-  const { is_admin } = request;
-  if (!is_admin) return response.status(403).json(Errors.UNAUTHORIZED);
-
-  next();
-};
-
-const authenticateBearerKey = async (request, response, next) => {
-  try {
-    const token = extract_token(request.headers);
-    request.tenant_id = await verifyAPIKey(token);
-    next();
-  } catch (e) {
-    authLogger.error(e, "authenticateBearerKey");
-    return response.status(403).json(Errors.UNAUTHORIZED);
-  }
-};
-
-const authenticateParamKey = async (request, response, next) => {
-  try {
-    const { api_key: token } = request.params;
-    request.tenant_id = await verifyAPIKey(token);
-    next();
-  } catch (e) {
-    authLogger.error(e, "authenticateParamKey");
-    return response.status(403).json(Errors.UNAUTHORIZED);
-  }
-};
-
-const authenticateUser = async (request, response, next) => {
-  try {
-    // env vars
-    const DEFAULT_TOKEN = Env.fetch("DEFAULT_TOKEN", true);
-    const ISSUER = Env.fetch("JWT_ISSUER", true);
-    const SECRET = Env.fetch("JWT_SECRET", true);
-
-    const token = extract_token(request.headers);
-    if (token === DEFAULT_TOKEN) {
-      // inter-service requests
-      request.is_service_request = true;
-      // typically scope requests by tenant_id
-      request.tenant_id = request.body.tenant_id || request.query.tenant_id || { $exists: true };
-      return next();
-    }
-
-    const { tenant_id, is_admin } = await jwt.verify(token, SECRET, { issuer: ISSUER });
-    request.is_admin = !!is_admin;
-    request.tenant_id = is_admin ? extract_tenant_id(request) : tenant_id;
-
-    next();
-  } catch (e) {
-    authLogger.error(e, "authenticateUser");
-    return response.status(403).json(Errors.UNAUTHORIZED);
-  }
-};
-
-module.exports = { authenticateAdmin, authenticateBearerKey, authenticateParamKey, authenticateUser };
+ const jwt = require("jsonwebtoken");
+ const Env = require("../env");
+ const Errors = require("./errors");
+ const { ProcessLogger } = require("./logger");
+ const { verifyAPIKey } = require("../clients/iam");
+ const authLogger = new ProcessLogger("Authenticator");
+ 
+ // helpers
+ const extractToken = (headers) => {
+   const { authorization } = headers;
+   if (!authorization) throw new Error("Unauthorized");
+ 
+   const [, token] = authorization.split(" ");
+   if (!token) throw new Error("Unauthorized");
+ 
+   return token;
+ };
+ 
+ const extractId = (request, key) => {
+   const { params, query, body } = request;
+   let id = { $exists: true };
+   if (query[key]) id = query[key];
+   if (params[key]) id = params[key];
+   if (body[key]) id = body[key];
+ 
+   return id;
+ };
+ 
+ // main
+ 
+ const authenticateAdmin = async (request, response, next) => {
+   const { is_admin } = request;
+   if (!is_admin) return response.status(403).json(Errors.UNAUTHORIZED);
+ 
+   next();
+ };
+ 
+ const authenticateBearerKey = async (request, response, next) => {
+   try {
+     const token = extractToken(request.headers);
+     request.tenant_id = await verifyAPIKey(token);
+     next();
+   } catch (e) {
+     authLogger.error(e, "authenticateBearerKey");
+     return response.status(403).json(Errors.UNAUTHORIZED);
+   }
+ };
+ 
+ const authenticateMembership = (tenant_id, memberships = []) => {
+   const membership = memberships.find((mbrship) => Number(mbrship.tenant_id) === Number(tenant_id));
+   if (!membership || membership.status !== "active") throw new Error("Unauthorized");
+   return tenant_id;
+ };
+ 
+ const authenticateParamKey = async (request, response, next) => {
+   try {
+     const { api_key: token } = request.params;
+     request.tenant_id = await verifyAPIKey(token);
+     next();
+   } catch (e) {
+     authLogger.error(e, "authenticateParamKey");
+     return response.status(403).json(Errors.UNAUTHORIZED);
+   }
+ };
+ 
+ const authenticateTenant = async (request, response, next) => {
+   try {
+     const tenant_id = extractId(request, "tenant_id");
+     request.tenant_id = request.is_admin ? tenant_id : authenticateMembership(tenant_id, request.memberships || []);
+ 
+     next();
+   } catch (e) {
+     authLogger.error(e, "authenticateUser");
+     return response.status(403).json(Errors.UNAUTHORIZED);
+   }
+ };
+ 
+ const authenticateUser = async (request, response, next) => {
+   try {
+     // env vars
+     const DEFAULT_TOKEN = Env.fetch("DEFAULT_TOKEN", true);
+     const ISSUER = Env.fetch("JWT_ISSUER", true);
+     const SECRET = Env.fetch("JWT_SECRET", true);
+ 
+     const token = extractToken(request.headers);
+     if (token === DEFAULT_TOKEN) {
+       // inter-service requests
+       request.is_service_request = true;
+       // typically scope requests by tenant_id
+       request.tenant_id = request.body.tenant_id || request.query.tenant_id || { $exists: true };
+       request.user_id = request.body.user_id || request.query.user_id || { $exists: true };
+       return next();
+     }
+ 
+     const { id: user_id, is_admin, memberships } = await jwt.verify(token, SECRET, { issuer: ISSUER });
+     request.is_admin = !!is_admin;
+     request.user_id = is_admin ? extractId(request, "user_id") : user_id;
+     request.memberships = memberships;
+ 
+     next();
+   } catch (e) {
+     authLogger.error(e, "authenticateUser");
+     return response.status(403).json(Errors.UNAUTHORIZED);
+   }
+ };
+ 
+ module.exports = {
+   authenticateAdmin,
+   authenticateBearerKey,
+   authenticateParamKey,
+   authenticateTenant,
+   authenticateUser,
+ };
+ 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@go-mailer/jarvis",
-  "version": "4.2.5",
+  "version": "5.0.1",
   "main": "index.js",
   "repository": "git@github.com:go-mailer-ltd/jarvis-node.git",
   "author": "Nathan Oguntuberu <nateoguns.work@gmail.com>",