@thzero/library_server_fastify 0.15.32 → 0.15.33

package/boot/index.js

@@ -1,9 +1,11 @@
 import path from 'path';
 
 import Fastify from 'fastify';
-import fastifyAuth from 'fastify-auth';
+// import fastifyAuth from 'fastify-auth';
+import fastifyAuth from '../plugins/auth';
 import fastifyCors from 'fastify-cors';
 import fastifyHelmet from 'fastify-helmet';
+import fastifyRoutes from 'fastify-routes';
 import fastifyStatic from 'fastify-static';
 
 import LibraryConstants from '@thzero/library_server/constants';
@@ -17,6 +19,9 @@ import pluginResponseTime from '@thzero/library_server_fastify/plugins/responseT
 import pluginSettings from '@thzero/library_server_fastify/plugins/settings';
 import pluginUsageMetrics from '@thzero/library_server_fastify/plugins/usageMetrics';
 
+import authenticationDefault from '../middleware/authentication';
+import authorizationDefault from '../middleware/authorization';
+
 class FastifyBootMain extends BootMain {
 	async _initApp(args, plugins) {
 		
@@ -32,6 +37,8 @@ class FastifyBootMain extends BootMain {
 		const fastify = Fastify({ logger: true });
 		const serverHttp = fastify.server;
 
+		await fastify.register(fastifyRoutes);
+
 		// // https://github.com/koajs/cors
 		// app.use(koaCors({
 		// 	allowMethods: 'GET,POST,DELETE',
@@ -41,23 +48,37 @@ class FastifyBootMain extends BootMain {
 		// 	origin: '*'
 		// }));
 		// https://github.com/fastify/fastify-cors
-		fastify.register(fastifyCors, { 
-			allowMethods: 'GET,POST,DELETE',
-			maxAge : 7200,
-			allowHeaders: `${LibraryConstants.Headers.AuthKeys.API}, ${LibraryConstants.Headers.AuthKeys.AUTH}, ${LibraryConstants.Headers.CorrelationId}, Content-Type`,
+		// fastify.register(fastifyCors, { 
+		// 	allowMethods: 'GET,POST,DELETE',
+		// 	maxAge : 7200,
+		// 	allowHeaders: `${LibraryConstants.Headers.AuthKeys.API}, ${LibraryConstants.Headers.AuthKeys.AUTH}, ${LibraryConstants.Headers.CorrelationId}, Content-Type`,
+		// 	credentials: true,
+		// 	origin: '*'
+		// });
+		const corsOptionsDefault = this._initCors({
+			allowHeaders: [ LibraryConstants.Headers.AuthKeys.API, LibraryConstants.Headers.AuthKeys.AUTH, LibraryConstants.Headers.CorrelationId, 'Content-Type' ],
 			credentials: true,
+			maxAge : 7200,
+			methods: ['GET', 'POST', 'DELETE'],
 			origin: '*'
 		});
+		await fastify.register(fastifyCors, (instance) => {
+			return (req, callback) => {
+				let corsOptions = corsOptionsDefault;
+				callback(null, corsOptions) // callback expects two parameters: error and options
+			}
+		});
 		
 		// // https://www.npmjs.com/package/koa-helmet
 		// app.use(koaHelmet());
 		// https://github.com/fastify/fastify-helmet
-		fastify.register(
-			fastifyHelmet,
+		const helmetOptions = this._initHelmet({ 
 			// Example disables the `contentSecurityPolicy` middleware but keeps the rest.
-			{ 
-				// contentSecurityPolicy: false 
-			}
+			// contentSecurityPolicy: false 
+		});
+		await fastify.register(
+			fastifyHelmet,
+			helmetOptions
 		);
 
 		// // error
@@ -77,7 +98,7 @@ class FastifyBootMain extends BootMain {
 		// 		});
 		// 	}
 		// });
-		fastify.register(async (instance, opts, done) => {
+		await fastify.register(async (instance, opts, done) => {
 			// try {
 			// 	done();
 			// }
@@ -117,7 +138,7 @@ class FastifyBootMain extends BootMain {
 
 		// 	done();
 		// });
-		fastify.register(pluginSettings, {
+		await fastify.register(pluginSettings, {
 			config: this._appConfig
 		});
 
@@ -136,14 +157,14 @@ class FastifyBootMain extends BootMain {
 		// 	ctx.set(ResponseTime, delta);
 		// });
 		// https://github.com/lolo32/fastify-response-time
-		fastify.register(pluginResponseTime, {
+		await fastify.register(pluginResponseTime, {
 			logger: this.loggerServiceI
 		});
 
 		// app.use(koaStatic('./public'));
 		// https://github.com/fastify/fastify-static
 		const __dirname = path.resolve();
-		fastify.register(fastifyStatic, {
+		await fastify.register(fastifyStatic, {
 			root: path.join(__dirname, 'public'),
 			prefix: '/public/', // optional: default '/'
 		});
@@ -218,15 +239,20 @@ class FastifyBootMain extends BootMain {
 
 		// 	done();
 		// });
-		fastify.register(pluginApiKey, {
+		await fastify.register(pluginApiKey, {
 			logger: this.loggerServiceI,
 			usageMetrics: this.usageMetricsServiceI
 		});
 
-		fastify.register(fastifyAuth, {
-			logger: this.loggerServiceI,
-			usageMetrics: this.usageMetricsServiceI
-		});
+		await fastify.register(fastifyAuth);
+
+		const capitalize = (word) => {
+			return word[0].toUpperCase() + word.slice(1).toLowerCase();
+		};
+		for (let [key, value] of this._initAuthentication(new Map()).entries())
+			fastify.decorate('authentication' + capitalize(key), value);
+		for (let [key, value] of this._initAuthorization(new Map()).entries())
+			fastify.decorate('authorization' + capitalize(key), value);
 
 		this._initPostAuth(fastify);
 
@@ -242,15 +268,18 @@ class FastifyBootMain extends BootMain {
 		console.log();
 
 		for (const route of this._routes) {
+			console.log(route);
 			await route.init(injector, fastify, this._appConfig);
+		}
 
-			console.log([ route.id ]);
-
-			// for (let i = 0; i < route.router.stack.length; i++)
-			// 	console.log([ route.router.stack[i].path, route.router.stack[i].methods ]);
-
-			console.log();
+		let methods;
+		for (let [key, value] of fastify.routes.entries()) {
+			methods = [];
+			for (let item of value)
+				methods.push(item.method);
+			console.log([ key, methods ]);
 		}
+		console.log();
 
 		// // usage metrics
 		// app.use(async (ctx, next) => {
@@ -259,7 +288,7 @@ class FastifyBootMain extends BootMain {
 		// 		this.loggerServiceI.error('KoaBootMain', 'start', 'usageMetrics', err);
 		// 	});
 		// });
-		fastify.register(pluginUsageMetrics, {
+		await fastify.register(pluginUsageMetrics, {
 			logger: this.loggerServiceI,
 			usageMetrics: this.usageMetricsServiceI
 		});
@@ -267,6 +296,16 @@ class FastifyBootMain extends BootMain {
 		return { app: fastify, server: serverHttp, listen: fastify.listen };
     }
 
+	_initAuthentication(map) {
+		map.set('default', authenticationDefault);
+		return map;
+	}
+
+	_initAuthorization(map) {
+		map.set('default', authorizationDefault);
+		return map;
+	}
+
 	_initAppListen(app, server, port, err) {
 		app.listen(port, err);
 	}
@@ -275,6 +314,15 @@ class FastifyBootMain extends BootMain {
 		this._initPostRoutes(app);
 	}
 
+	_initCors(options) {
+		// https://github.com/fastify/fastify-cors
+		return options;
+	}
+
+	_initHelmet(options) {
+		return options;
+	}
+
 	_initRoute(route) {
 		this._routes.push(route);
 	}

package/boot/plugins/apiFront.js

@@ -1,8 +1,18 @@
 import BaseApiFrontBootPlugin from '@thzero/library_server/boot/plugins/apiFront';
 
+import homeRoute from '../../routes/home';
 import utilityRoute from '../../routes/utility';
+import versionRoute from '../../routes/version';
 
 class FrontApiBootPlugin extends BaseApiFrontBootPlugin {
+	_initRoutesHome() {
+		return new homeRoute();
+	}
+
+	_initRoutesVersion() {
+		return new versionRoute();
+	}
+
 	_initRoutesUtility() {
 		return new utilityRoute();
 	}

package/boot/plugins/usersExtended.js

@@ -1,11 +1,6 @@
 import BaseExtendedUsersApiBootPlugin from '@thzero/library_server/boot/plugins/usersExtended';
 
-import plansService from '../../service/plans';
-
 class ExtendedUsersApiBootPlugin extends BaseExtendedUsersApiBootPlugin {
-	_initServicesPlans() {
-		return new plansService();
-	}
 }
 
 export default ExtendedUsersApiBootPlugin;

package/middleware/authentication.js

@@ -0,0 +1,78 @@
+import LibraryConstants from '@thzero/library_server/constants';
+import LibraryCommonServiceConstants from '@thzero/library_common_service/constants';
+
+import injector from '@thzero/library_common/utility/injector';
+
+const separator = ': ';
+
+function getAuthToken(request, logger) {
+	if (!request)
+		return null;
+	if (!logger)
+		return null;
+
+	const token = request.headers[LibraryConstants.Headers.AuthKeys.AUTH];
+	logger.debug('middleware', 'getAuthToken', 'token', token, request.correlationId);
+	const split = token.split(LibraryConstants.Headers.AuthKeys.AUTH_BEARER + separator);
+	logger.debug('middleware', 'getAuthToken', 'split', split, request.correlationId);
+	logger.debug('middleware', 'getAuthToken', 'split.length', split.length, request.correlationId);
+	if (split.length > 1)
+		return split[1];
+
+	logger.debug('middleware', 'getAuthToken', 'fail', null, request.correlationId);
+	return null;
+}
+
+export default async (request, reply, done, options) => {
+	const logger = injector.getService(LibraryCommonServiceConstants.InjectorKeys.SERVICE_LOGGER);
+
+	const required = options && (options.required !== null) && (options.required !== undefined) ? options.required : true;
+
+	const token = getAuthToken(request, logger);
+	logger.debug('middleware', 'authentication', 'token', token, request.correlationId);
+	logger.debug('middleware', 'authentication', 'required', required, request.correlationId);
+	const valid = ((required && !String.isNullOrEmpty(token)) || !required);
+	logger.debug('middleware', 'authentication', 'valid', valid, request.correlationId);
+	if (valid) {
+		if (!String.isNullOrEmpty(token)) {
+			const service = injector.getService(LibraryConstants.InjectorKeys.SERVICE_AUTH);
+			const results = await service.verifyToken(request.correlationId, token);
+			logger.debug('middleware', 'authentication', 'results', results, request.correlationId);
+			if (!results || !results.success) {
+				logger.warn('middleware', 'authentication', 'Unauthenticated... invalid token', null, request.correlationId);
+				ctx.throw(401);
+				return;
+			}
+
+			request.token = token;
+			request.user = results.user;
+			request.claims = results.claims;
+		}
+
+		// done(); // not for async
+		return;
+	}
+
+	(async () => {
+		const usageMetrics = {
+			url: request.routerPath,
+			correlationId: request.correlationId,
+			href: request.url,
+			headers: request.headers,
+			host: request.hostname,
+			hostname: request.hostname,
+			querystring: request.query,
+			token: request.token
+		};
+		const serviceUsageMetrics = injector.getService(LibraryConstants.InjectorKeys.SERVICE_USAGE_METRIC);
+		await serviceUsageMetrics.register(usageMetrics).catch((err) => {
+			// const logger = injector.getService(LibraryCommonServiceConstants.InjectorKeys.SERVICE_LOGGER);
+			logger.error('middleware', 'authentication', err, null, request.correlationId);
+		});
+	})();
+
+	logger.warn('middleware', 'authentication', 'Unauthorized... authentication unknown', null, request.correlationId);
+	// reply.code(401);
+	// done(new Error('Unauthorized... authentication unknown')); // not for async
+	throw new Error('Unauthorized... authentication unknown');
+}

package/middleware/authorization.js

@@ -0,0 +1,200 @@
+import LibraryConstants from '@thzero/library_server/constants';
+import LibraryCommonServiceConstants from '@thzero/library_common_service/constants';
+
+import injector from '@thzero/library_common/utility/injector';
+
+// require('../utility/string.cjs');
+String.isNullOrEmpty = function(value) {
+	//return !(typeof value === 'string' && value.length > 0)
+	return !value;
+}
+
+String.isString = function(value) {
+	return (typeof value === "string" || value instanceof String);
+}
+
+String.trim = function(value) {
+	if (!value || !String.isString(value))
+		return value;
+	return value.trim();
+}
+
+const logicalAnd = 'and';
+const logicalOr = 'or';
+
+const authorizationCheckClaims = async (request, success, logical, security, logger) => {
+	if (!request)
+		return false;
+	if (!(request.claims && Array.isArray(request.claims)))
+		return false;
+
+	let result;
+	let roleAct;
+	let roleObj;
+	let roleParts;
+	for (const claim of request.claims) {
+		logger.debug('middleware', 'authorization', 'authorization.claim', claim, request.correlationId);
+
+		for (const role of request.roles) {
+			logger.debug('middleware', 'authorization', 'role', role, request.correlationId);
+
+			roleParts = role.split('.');
+			if (roleParts && roleParts.length < 1)
+				success = false;
+
+			roleObj = roleParts[0];
+			roleAct = roleParts.length >= 2 ? roleParts[1] : null
+
+			result = await security.validate(claim, null, roleObj, roleAct);
+			logger.debug('middleware', 'authorization', 'result', result, request.correlationId);
+			if (logical === logicalOr)
+				success = success || result;
+			else
+				success = success && result;
+		}
+	}
+
+	return success;
+}
+
+const authorizationCheckRoles = async (request, success, logical, security, logger) => {
+	if (!request)
+		return false;
+
+	logger.debug('middleware', 'authorizationCheckRoles', 'user', request.user, request.correlationId);
+	if (!(request.user && request.user.roles && Array.isArray(request.user.roles)))
+		return false;
+
+	logger.debug('middleware', 'authorizationCheckRoles', 'logical', logical, request.correlationId);
+
+	let result;
+	let roleAct;
+	let roleObj;
+	let roleParts;
+	for (const userRole of request.user.roles) {
+		logger.debug('middleware', 'authorizationCheckRoles', 'userRole', userRole, request.correlationId);
+
+		for (const role of request.roles) {
+			logger.debug('middleware', 'authorizationCheckRoles', 'role', role, request.correlationId);
+
+			roleParts = role.split('.');
+			if (roleParts && roleParts.length < 1)
+				success = false;
+
+			roleObj = roleParts[0];
+			roleAct = roleParts.length >= 2 ? roleParts[1] : null
+
+			result = await security.validate(userRole, null, roleObj, roleAct);
+			logger.debug('middleware', 'authorizationCheckRoles', 'result', result, request.correlationId);
+			if (logical === logicalOr) {
+				if (result)
+					return result;
+
+				success = false;
+			}
+			else
+				success = success && result;
+		}
+	}
+
+	return success;
+}
+
+const initalizeRoles = (request, roles, logger) => {
+	if (Array.isArray(roles)) {
+		// logger.debug('middleware', 'initalizeRoles', 'roles1a', roles);
+		request.roles = roles;
+	}
+	else if ((typeof(roles) === 'string') || (roles instanceof String)) {
+		// logger.debug('middleware', 'initalizeRoles', 'roles1b', roles);
+		request.roles = roles.split(',');
+		request.roles.map(item => item ? item.trim() : item);
+	}
+}
+
+// const authorization = (roles, logical) => {
+// 	if (String.isNullOrEmpty(logical) || (logical !== logicalAnd) || (logical !== logicalOr))
+// 		logical = logicalOr;
+
+export default async (request, reply, done, options) => {
+	let logical = logicalOr;
+	let roles = [];
+	if (options) {
+		logical = options.logical;
+		if (String.isNullOrEmpty(logical) || (logical !== logicalAnd) || (logical !== logicalOr))
+			logical = logicalOr;
+		
+		if (options.roles && Array.isArray(options.roles) && (options.roles.length > 0))
+			roles = options.roles;
+	}
+
+	const config = injector.getService(LibraryCommonServiceConstants.InjectorKeys.SERVICE_CONFIG);
+	const logger = injector.getService(LibraryCommonServiceConstants.InjectorKeys.SERVICE_LOGGER);
+	const security = injector.getService(LibraryConstants.InjectorKeys.SERVICE_SECURITY);
+
+	// logger.debug('token', request.token);
+	logger.debug('middleware', 'authorization', 'user', request.user, request.correlationId);
+	logger.debug('middleware', 'authorization', 'claims', request.claims, request.correlationId);
+	logger.debug('middleware', 'authorization', 'roles1', roles, request.correlationId);
+	request.roles = [];
+	if (roles) {
+		// logger.debug('authorization.roles1', roles);
+		// logger.debug('authorization.roles1', (typeof roles));
+		// logger.debug('authorization.roles1', Array.isArray(roles));
+		// logger.debug('authorization.roles1', ((typeof(roles) === 'string') || (roles instanceof String)));
+		// if (Array.isArray(roles)) {
+		// 	// logger.debug('authorization.roles1a', roles);
+		// 	request.roles = roles;
+		// }
+		// else if ((typeof(roles) === 'string') || (roles instanceof String)) {
+		// 	// logger.debug('authorization.roles1b', roles);
+		// 	request.roles = roles.split(',');
+		// 	request.roles.map(item => item ? item.trim() : item);
+		// }
+		initalizeRoles(request, roles, logger);
+	}
+	logger.debug('middleware', 'authorization', 'roles2', request.roles, request.correlationId);
+
+	let success = false; //(logical === logicalOr ? false : true);
+	if (request.roles && Array.isArray(request.roles) && (request.roles.length > 0)) {
+		const auth = config.get('auth');
+		if (auth) {
+			logger.debug('middleware', 'authorization', 'auth.claims', auth.claims, request.correlationId);
+			logger.debug('middleware', 'authorization', 'auth.claims.check', auth.claims.check, request.correlationId);
+		}
+		if (auth && auth.claims && auth.claims.check)
+			success = await authorizationCheckClaims(request, (logical === logicalOr ? false : true), logical, security, logger);
+
+		if (!success)
+			success = await authorizationCheckRoles(request, (logical === logicalOr ? false : true), logical, security, logger);
+	}
+
+	logger.debug('middleware', 'authorization', 'success', null, request.success, request.correlationId);
+	if (success) {
+		// done(); // not for async
+		return;
+	}
+
+	(async () => {
+		const usageMetrics = {
+			url: request.routerPath,
+			correlationId: request.correlationId,
+			href: request.url,
+			headers: request.headers,
+			host: request.hostname,
+			hostname: request.hostname,
+			querystring: request.query,
+			token: request.token
+		};
+		const serviceUsageMetrics = injector.getService(LibraryConstants.InjectorKeys.SERVICE_USAGE_METRIC);
+		await serviceUsageMetrics.register(usageMetrics).catch((err) => {
+			// const logger = injector.getService(LibraryCommonServiceConstants.InjectorKeys.SERVICE_LOGGER);
+			logger.error('middleware', 'authorization', err, null, request.correlationId);
+		});
+	})();
+
+	logger.warn('middleware', 'authorization', 'Unauthorized... authorization unknown', null, request.correlationId);
+	// reply.code(401);
+	// done(new Error('Unauthorized... authentication unknown')); // not for async
+	throw new Error('Unauthorized... authentication unknown');
+}

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@thzero/library_server_fastify",
   "type": "module",
-  "version": "0.15.32",
+  "version": "0.15.33",
   "version_major": 0,
   "version_minor": 15,
-  "version_patch": 32,
-  "version_date": "04/18/2022",
+  "version_patch": 33,
+  "version_date": "04/19/2022",
   "description": "An opinionated library of common functionality to bootstrap a Fastify based API application.",
   "author": "thZero",
   "license": "MIT",
@@ -31,11 +31,9 @@
     "fastify-auth": "^1.1.0",
     "fastify-cors": "^6.0.3",
     "fastify-helmet": "^7.0.1",
+    "fastify-routes": "^3.1.0",
     "fastify-static": "^4.6.1"
   },
-  "devDependencies": {
-    "@thzero/library_cli": "^0.15"
-  },
   "peerDependencies": {
     "@thzero/library_common": "^0.15",
     "@thzero/library_common_service": "^0.15"

package/plugins/auth.js

@@ -0,0 +1,123 @@
+'use strict'
+
+// const fp = require('fastify-plugin')
+import fp from 'fastify-plugin'
+// const reusify = require('reusify')
+import reusify from 'reusify'
+
+function checkAuth (fastify, opts, next) {
+  fastify.decorate('auth', auth)
+  next()
+}
+
+function auth (functions, opts) {
+  if (!Array.isArray(functions)) {
+    throw new Error('You must give an array of functions to the auth function')
+  }
+  if (!functions.length) {
+    throw new Error('Missing auth functions')
+  }
+
+  const options = Object.assign({
+    relation: 'or',
+    run: null
+  }, opts)
+
+  if (options.relation !== 'or' && options.relation !== 'and') {
+    throw new Error('The value of options.relation should be one of [\'or\', \'and\']')
+  }
+  if (options.run && options.run !== 'all') {
+    throw new Error('The value of options.run must be \'all\'')
+  }
+
+  /* eslint-disable-next-line no-var */
+  for (var i = 0; i < functions.length; i++) {
+    functions[i] = functions[i].bind(this)
+  }
+
+  const instance = reusify(Auth)
+
+  function _auth (request, reply, done) {
+    const obj = instance.get()
+
+    obj.request = request
+    obj.reply = reply
+    obj.done = done
+    obj.functions = this.functions
+    obj.options = this.options
+    obj.i = 0
+    obj.start = true
+    obj.firstResult = null
+
+    obj.nextAuth()
+  }
+
+  return _auth.bind({ functions, options })
+
+  function Auth () {
+    this.next = null
+    this.i = 0
+    this.start = true
+    this.functions = []
+    this.options = {}
+    this.request = null
+    this.reply = null
+    this.done = null
+    this.firstResult = null
+
+    const that = this
+
+    this.nextAuth = function nextAuth (err) {
+      const func = that.functions[that.i++]
+
+      if (!func) {
+        that.completeAuth(err)
+        return
+      }
+
+      const maybePromise = func(that.request, that.reply, that.onAuth, that.options)
+
+      if (maybePromise && typeof maybePromise.then === 'function') {
+        maybePromise.then(results => that.onAuth(null, results), that.onAuth)
+      }
+    }
+
+    this.onAuth = function onAuth (err, results) {
+      if (that.options.relation === 'or') {
+        if (err) {
+          return that.nextAuth(err)
+        }
+
+        return that.completeAuth()
+      } else {
+        if (err) {
+          return that.completeAuth(err)
+        }
+
+        return that.nextAuth(err)
+      }
+    }
+
+    this.completeAuth = function (err) {
+      if (that.start) {
+        that.start = false
+        that.firstResult = err
+      }
+
+      if (that.options.run === 'all' && that.i < that.functions.length) {
+        return that.nextAuth(err)
+      }
+
+      if (that.firstResult && (!that.reply.raw.statusCode || that.reply.raw.statusCode < 400)) {
+        that.reply.code(401)
+      } else if (!that.firstResult && that.reply.raw.statusCode && that.reply.raw.statusCode >= 400) {
+        that.reply.code(200)
+      }
+
+      that.done(that.firstResult)
+      instance.release(that)
+    }
+  }
+}
+
+export default fp(checkAuth, '3.x')

package/plugins/responseTime.js

@@ -65,24 +65,29 @@ export default fastifyPlugin((instance, opts, done) => {
 
 	// Hook to be triggered just before response to be send
 	instance.addHook('onSend', (request, reply, payload, next) => {
+		const headers = [];
+
 		// check if Server-Timing need to be added
 		const serverTiming = (reply.raw ? reply.raw[symbolServerTiming] : reply.res[symbolServerTiming]);
-		const headers = [];
-		for (const name of Object.keys(serverTiming)) {
-			headers.push(serverTiming[name]);
-		}
-		if (headers.length) {
-			reply.header('Server-Timing', headers.join(','));
+		if (serverTiming) {
+			for (const name of Object.keys(serverTiming)) {
+				headers.push(serverTiming[name]);
+			}
+			if (headers.length) {
+				reply.header('Server-Timing', headers.join(','));
+			}
 		}
 
 		// Calculate the duration, in nanoseconds …
 		const hrDuration = (request.raw ? request.raw[symbolRequestTime] : request.req[symbolRequestTime]);
-		// … convert it to milliseconds …
-		const duration = (hrDuration[0] * 1e3 + hrDuration[1] / 1e6).toFixed(opts.digits);
-		// … add the header to the response
-		reply.header(opts.header, duration);
+		if (hrDuration) {
+			// … convert it to milliseconds …
+			const duration = (hrDuration[0] * 1e3 + hrDuration[1] / 1e6).toFixed(opts.digits);
+			// … add the header to the response
+			reply.header(opts.header, duration);
 
-		opts.logger.info2(`${request.method} ${request.url} - ${duration}`);
+			opts.logger.info2(`${request.method} ${request.url} - ${duration}`);
+		}
 
 		next();
 	});

package/routes/admin/index.js

@@ -1,12 +1,7 @@
-import koaBody from 'koa-body';
-
-import Utility from '@thzero/library_common/utility';
+import LibraryUtility from '@thzero/library_common/utility';
 
 import BaseRoute from '../index';
 
-import authentication from '../../middleware/authentication';
-import authorization from '../../middleware/authorization';
-
 class AdminBaseRoute extends BaseRoute {
 	constructor(urlFragment, role, serviceKey) {
 		if (!urlFragment)
@@ -22,10 +17,9 @@ class AdminBaseRoute extends BaseRoute {
 		// this._service = null;
 	}
 
-	async init(injector, config) {
-		const router = await super.init(injector, config);
-		router.service = injector.getService(this._options.serviceKey);
-		// this._service = injector.getService(this._options.serviceKey);
+	async init(injector, app, config) {
+		await super.init(injector, app, config);
+		this._inject(app, injector, this._options.serviceKey, this._options.serviceKey);
 	}
 
 	_allowsCreate() {
@@ -42,51 +36,67 @@ class AdminBaseRoute extends BaseRoute {
 
 	_initializeRoutesCreate(router) {
 		const self = this;
-		router.post('/',
-			authentication(true),
-			authorization([ `${self._options.role}.create` ]),
-			koaBody({
-				text: false,
-			}),
+		router.post(this._join('/'),
+			// authentication(true),
+			// authorization([ `${self._options.role}.create` ]),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					roles: [ `${self._options.role}.create` ]
+				}),
+			},
 			// eslint-disable-next-line
-			async (ctx, next) => {
-				// const service = this._injector.getService(this._options.serviceKey);
-				// const response = (await router.service.create(ctx.correlationId, ctx.state.user, ctx.request.body)).check(ctx);
-				const response = (await ctx.router.service.create(ctx.correlationId, ctx.state.user, ctx.request.body)).check(ctx);
-				this._jsonResponse(ctx, Utility.stringify(response));
+			async (request, reply) => {
+				const response = (await router[this._options.serviceKey].create(request.correlationId, request.user, request.body)).check(request);
+				this._jsonResponse(reply, LibraryUtility.stringify(response));
 			}
 		);
 	}
 
 	_initializeRoutesDelete(router) {
-		const self = this;
-		router.delete('/:id',
-			authentication(true),
-			authorization([ `${self._options.role}.delete` ]),
+		router.delete(this._join('/:id'),
+			// authentication(true),
+			// authorization([ `${this._options.role}.delete` ]),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					roles: [ `${this._options.role}.delete` ]
+				}),
+			},
 			// eslint-disable-next-line
-			async (ctx, next) => {
-				// const service = this._injector.getService(this._options.serviceKey);
-				// const response = (await service.delete(ctx.correlationId, ctx.state.user, ctx.params.id)).check(ctx);
-				const response = (await ctx.router.service.delete(ctx.correlationId, ctx.state.user, ctx.params.id)).check(ctx);
-				this._jsonResponse(ctx, Utility.stringify(response));
+			async (request, reply) => {
+				const response = (await router[this._options.serviceKey].delete(request.correlationId, request.user, request.params.id)).check(request);
+				this._jsonResponse(reply, LibraryUtility.stringify(response));
 			}
 		);
 	}
 
 	_initializeRoutesUpdate(router) {
-		const self = this;
-		router.post('/:id',
-			authentication(true),
-			authorization([ `${self._options.role}.update` ]),
-			koaBody({
-				text: false,
-			}),
+		router.post(this._join('/:id'),
+			// authentication(true),
+			// authorization([ `${this._options.role}.update` ]),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					roles: [ `${this._options.role}.update` ]
+				}),
+			},
 			// eslint-disable-next-line
-			async (ctx, next) => {
-				// const service = this._injector.getService(this._options.serviceKey);
-				// const response = (await service.update(ctx.correlationId, ctx.state.user, ctx.params.id, ctx.request.body)).check(ctx);
-				const response = (await ctx.router.service.update(ctx.correlationId, ctx.state.user, ctx.params.id, ctx.request.body)).check(ctx);
-				this._jsonResponse(ctx, Utility.stringify(response));
+			async (request, reply) => {
+				const response = (await router[this._options.serviceKey].update(request.correlationId, request.user, request.params.id, request.body)).check(request);
+				this._jsonResponse(reply, LibraryUtility.stringify(response));
 			}
 		);
 	}
@@ -95,18 +105,23 @@ class AdminBaseRoute extends BaseRoute {
 		if (this._allowsDelete)
 			this._initializeRoutesDelete(router);
 
-		router.post('/search',
-			authentication(true),
-			authorization([ `${this._options.role}.search` ]),
-			koaBody({
-				text: false,
-			}),
+		router.post(this._join('/search'),
+			// authentication(true),
+			// authorization([ `${this._options.role}.search` ]),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					roles: [ `${this._options.role}.search` ]
+				}),
+			},
 			// eslint-disable-next-line
-			async (ctx, next) => {
-				// const service = this._injector.getService(this._options.serviceKey);
-				// const response = (await service.search(ctx.correlationId, ctx.state.user, ctx.request.body)).check(ctx);
-				const response = (await ctx.router.service.search(ctx.correlationId, ctx.state.user, ctx.request.body)).check(ctx);
-				this._jsonResponse(ctx, Utility.stringify(response));
+			async (request, reply) => {
+				const response = (await router[this._options.serviceKey].search(request.correlationId, request.user, request.body)).check(request);
+				this._jsonResponse(reply, LibraryUtility.stringify(response));
 			}
 		);
 

package/routes/admin/news.js

@@ -1,4 +1,4 @@
-import LibraryConstants from '../../constants';
+import LibraryConstants from '@thzero/library_server/constants';
 
 import AdminRoute from './index'
 

package/routes/admin/users.js

@@ -1,4 +1,4 @@
-import LibraryConstants from '../../constants';
+import LibraryConstants from '@thzero/library_server/constants';
 
 import AdminRoute from './index'
 

package/routes/baseNews.js

@@ -1,11 +1,9 @@
-import LibraryConstants from '../constants';
+import LibraryConstants from '@thzero/library_server/constants';
 
 import Utility from '@thzero/library_common/utility';
 
 import BaseRoute from './index';
 
-import authentication from '../middleware/authentication';
-
 class BaseNewsRoute extends BaseRoute {
 	constructor(prefix, version) {
 		super(prefix ? prefix : '/news');
@@ -24,12 +22,22 @@ class BaseNewsRoute extends BaseRoute {
 	}
 
 	_initializeRoutes(router) {
-		// authentication(false),
 		router.get(this._join('/latest/:date'), 
+			// authentication(false),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					// router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					required: false,
+					roles: [ 'news' ]
+				}),
+			},
 			async (request, reply) => {
 				// const service = this._injector.getService(LibraryConstants.InjectorKeys.SERVICE_NEWS);
-				// const response = (await service.latest(ctx.correlationId, ctx.state.user, parseInt(ctx.params.date))).check(ctx);
-				const response = (await request.serviceNews.latest(request.correlationId, request.user, parseInt(request.params.date))).check(request);
+				const response = (await router[LibraryConstants.InjectorKeys.SERVICE_NEWS].latest(request.correlationId, request.user, parseInt(request.params.date))).check(request);
 				this._jsonResponse(reply, Utility.stringify(response));
 			});
 	}

package/routes/baseUsers.js

@@ -1,14 +1,9 @@
-import koaBody from 'koa-body';
-
-import LibraryConstants from '../constants';
+import LibraryConstants from '@thzero/library_server/constants';
 
 import Utility from '@thzero/library_common/utility';
 
 import BaseRoute from './index';
 
-import authentication from '../middleware/authentication';
-import authorization from '../middleware/authorization';
-
 class BaseUsersRoute extends BaseRoute {
 	constructor(prefix, version) {
 		super(prefix ? prefix : '/users');
@@ -35,9 +30,20 @@ class BaseUsersRoute extends BaseRoute {
 	}
 
 	_initializeRoutesGamerById(router) {
-		return router.get('/gamerId/:gamerId',
+		return router.get(this._join('/gamerId/:gamerId'),
 			// authentication(false),
 			// // authorization('user'),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					// router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					required: false,
+					roles: [ 'user' ]
+				}),
+			},
 			// eslint-disable-next-line
 			async (request, reply) => {
 				// const service = this._injector.getService(LibraryConstants.InjectorKeys.SERVICE_USERS);
@@ -48,9 +54,20 @@ class BaseUsersRoute extends BaseRoute {
 	}
 
 	_initializeRoutesGamerByTag(router) {
-		return router.get('/gamerTag/:gamerTag',
+		return router.get(this._join('/gamerTag/:gamerTag'),
 			// authentication(false),
 			// // authorization('user'),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					// router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					required: false,
+					roles: [ 'user' ]
+				}),
+			},
 			// eslint-disable-next-line
 			async (request, reply) => {
 				// const service = this._injector.getService(LibraryConstants.InjectorKeys.SERVICE_USERS);
@@ -61,9 +78,19 @@ class BaseUsersRoute extends BaseRoute {
 	}
 
 	_initializeRoutesRefreshSettings(router) {
-		return router.post('/refresh/settings',
+		return router.post(this._join('/refresh/settings'),
 			// authentication(true),
 			// authorization('user'),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					roles: [ 'user' ]
+				}),
+			},
 			// eslint-disable-next-line
 			async (request, reply) => {
 				// const service = this._injector.getService(LibraryConstants.InjectorKeys.SERVICE_USERS);
@@ -74,9 +101,19 @@ class BaseUsersRoute extends BaseRoute {
 	}
 
 	_initializeRoutesUpdate(router) {
-		return router.post('/update',
+		return router.post(this._join('/update'),
 			// authentication(true),
 			// authorization('user'),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					// router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					roles: [ 'user' ]
+				}),
+			},
 			// eslint-disable-next-line
 			async (request, reply) => {
 				// const service = this._injector.getService(LibraryConstants.InjectorKeys.SERVICE_USERS);
@@ -87,9 +124,19 @@ class BaseUsersRoute extends BaseRoute {
 	}
 
 	_initializeRoutesUpdateSettings(router) {
-		return router.post('/update/settings',
+		return router.post(this._join('/update/settings'),
 			// authentication(true),
 			// authorization('user'),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					roles: [ 'user' ]
+				}),
+			},
 			// eslint-disable-next-line
 			async (request, reply) => {
 				// const service = this._injector.getService(LibraryConstants.InjectorKeys.SERVICE_USERS);

package/routes/plans.js

@@ -1,4 +1,4 @@
-import LibraryConstants from '../constants';
+import LibraryConstants from '@thzero/library_server/constants';
 
 import Utility from '@thzero/library_common/utility';
 
@@ -24,9 +24,9 @@ class PlansRoute extends BaseRoute {
 	_initializeRoutes(router) {
 		router.get(this._join('/'),
 			// eslint-disable-next-line
-			async (ctx, next) => {
+			async (request, reply) => {
 				// const service = this._injector.getService(LibraryConstants.InjectorKeys.SERVICE_PLANS);
-				const response = (await router[LibraryConstants.InjectorKeys.SERVICE_PLANS].logger(request.correlationI)).check(request);
+				const response = (await router[LibraryConstants.InjectorKeys.SERVICE_PLANS].listing(request.correlationId, request.body)).check(request);
 				this._jsonResponse(reply, Utility.stringify(response));
 			}
 		);

package/routes/utility.js

@@ -1,14 +1,9 @@
-import koaBody from 'koa-body';
-
-import LibraryConstants from '../constants';
+import LibraryConstants from '@thzero/library_server/constants';
 
 import Utility from '@thzero/library_common/utility';
 
 import BaseRoute from './index';
 
-import authentication from '../middleware/authentication';
-// import authorization from '../middleware/authorization';
-
 class UtilityRoute extends BaseRoute {
 	constructor(prefix) {
 		super(prefix ? prefix : '/utility');
@@ -28,16 +23,23 @@ class UtilityRoute extends BaseRoute {
 
 	_initializeRoutes(router) {
 		router.post('/logger',
-			authentication(false),
-			// authorization('utility'),
-			// eslint-disable-next-line,
-			koaBody({
-				text: false,
-			}),
-			async (ctx, next) => {
+			// authentication(false),
+			// // authorization('utility'),
+			{
+				preHandler: router.auth([
+					router.authenticationDefault,
+					// router.authorizationDefault
+				], 
+				{ 
+					relation: 'and',
+					required: false,
+					roles: [ 'utility' ]
+				}),
+			},
+			// eslint-disable-next-line
+			async (request, reply) => {
 				// const service = this._injector.getService(LibraryConstants.InjectorKeys.SERVICE_UTILITY);
-				// const response = (await service.logger(ctx.correlationId, ctx.request.body)).check(ctx);
-				const response = (await router[LibraryConstants.InjectorKeys.SERVICE_UTILITY].logger(request.correlationI, request.body)).check(request);
+				const response = (await router[LibraryConstants.InjectorKeys.SERVICE_UTILITY].logger(request.correlationId, request.body)).check(request);
 				this._jsonResponse(reply, Utility.stringify(response));
 			}
 		);