corebasic 1.0.7 → 1.0.8

package/libs/app.js

@@ -3,9 +3,11 @@
 let Elabase = require('./elabase')
 let Kafka = require('./kafka')
 let Utils = require('./utils')
+let Session = require('./session')
 
 module.exports = {
     Elabase,
     Kafka,
-    Utils
-}
+    Utils,
+    Session
+}

package/libs/session.js

@@ -0,0 +1,66 @@
+const jwt = require('jsonwebtoken');
+let app
+
+module.exports = {
+    start,
+    generateAccessToken,
+}
+
+
+
+const ACCESS_TOKEN_SECRET = process.env.JWT_ACCESS_TOKEN_SECRET || "MY_SECRET_ACCESS_TOKEN";
+const REFRESH_TOKEN_SECRET = process.env.JWT_REFRESH_TOKEN_SECRET || "MY_SECRET_REFRESH_TOKEN";
+
+let urlsAllowed = []
+
+function start(expressApp, allowedUrls) {
+    urlsAllowed = ["/refreshToken"].concat(allowedUrls)
+    app = expressApp
+
+
+    app.use((req, res, next) => {
+
+        // return next()    // Disable session
+
+        if (urlsAllowed.includes(req.path))
+            return next()
+
+        try {
+            const token = req.header('JWT');    //  'Authorization' for Spring Boot, 'x-access-token' for Node.js Express back-end
+            if (jwt.verify(token, ACCESS_TOKEN_SECRET))
+                return next()
+            throw null;
+        } catch (error) {
+            return res.status(406).json({ message: 'Unauthorized' })
+        }
+    })
+
+    app.post("/refreshToken", (req, res) => {
+        try {
+            let { userId, clientId, refreshToken } = req.body
+            const decoded = jwt.verify(refreshToken, REFRESH_TOKEN_SECRET)
+            if (decoded.userId === userId && decoded.clientId === clientId) {
+                const accessToken = jwt.sign({ userId, clientId }, ACCESS_TOKEN_SECRET, { expiresIn: '1d' });
+                const refreshToken = jwt.sign({ userId, clientId }, REFRESH_TOKEN_SECRET, { expiresIn: '30d' });
+                return res.json({ tokens: { accessToken, refreshToken } });
+            }
+            // Access Denied
+            throw null;
+
+        } catch (error) {
+            // Access Denied
+            return res.status(406).json({ message: 'Unauthorized' })
+        }
+    });
+}
+
+
+function generateAccessToken(userId, clientId) {
+    let data = { userId, clientId }
+
+    const accessToken = jwt.sign(data, ACCESS_TOKEN_SECRET, { expiresIn: '1d' });
+    const refreshToken = jwt.sign(data, REFRESH_TOKEN_SECRET, { expiresIn: '30d' });
+    return { accessToken, refreshToken };
+}
+
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "corebasic",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "",
   "main": "index.js",
   "scripts": {