@actonate/mirkwood/dist/lib/authenticator.js

GraphQL based Rapid Server-side Development framework

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});

var _createClass = function () { function defineProperties(target, props) { for (var i = 0; i < props.length; i++) { var descriptor = props[i]; descriptor.enumerable = descriptor.enumerable || false; descriptor.configurable = true; if ("value" in descriptor) descriptor.writable = true; Object.defineProperty(target, descriptor.key, descriptor); } } return function (Constructor, protoProps, staticProps) { if (protoProps) defineProperties(Constructor.prototype, protoProps); if (staticProps) defineProperties(Constructor, staticProps); return Constructor; }; }();

var _jsonwebtoken = require('jsonwebtoken');

var _jsonwebtoken2 = _interopRequireDefault(_jsonwebtoken);

var _types = require('./types');

var _types2 = _interopRequireDefault(_types);

var _errors = require('../errors');

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

function _classCallCheck(instance, Constructor) { if (!(instance instanceof Constructor)) { throw new TypeError("Cannot call a class as a function"); } }

var Authenticator = function () {
  function Authenticator() {
    _classCallCheck(this, Authenticator);
  }

  _createClass(Authenticator, null, [{
    key: 'init',
    value: function init(_ref) {
      var config = _ref.config;

      this.config = config;
    }
  }, {
    key: 'authenticate',
    value: function authenticate(_ref2, request) {
      var role = _ref2.role,
          user = _ref2.user,
          _ref2$permissions = _ref2.permissions,
          permissions = _ref2$permissions === undefined ? [] : _ref2$permissions;

      request.session.auth = {
        role: role,
        user: user,
        permissions: permissions
      };
    }
  }, {
    key: 'token',
    value: function token(_ref3) {
      var role = _ref3.role,
          user = _ref3.user,
          _ref3$permissions = _ref3.permissions,
          permissions = _ref3$permissions === undefined ? [] : _ref3$permissions;

      var tokenConfig = this.config.token || {};
      if (!tokenConfig.secret) {
        throw 'Secret for signing JWT not specified in Auth config (auth.js)';
      }

      var token = _jsonwebtoken2.default.sign({ role: role, user: user, permissions: permissions }, tokenConfig.secret, tokenConfig.options);
      return token;
    }
  }, {
    key: 'user',
    value: function user(request) {
      var tokenConfig = this.config.token || {};
      var authorization = request.headers['authorization'];

      // default to session auth
      var userAuth = request.session.auth || {};

      if (authorization && authorization.split(' ')[0] === 'Bearer') {
        var token = authorization ? authorization.split(' ')[1] : false;

        if (!token) {
          userAuth = {};
        }

        try {
          userAuth = _jsonwebtoken2.default.verify(token, tokenConfig.secret);
        } catch (err) {
          if (err && err.name === 'TokenExpiredError') {
            // expired
            throw new _errors.AuthenticationTokenExpiredError();
          }
          // return invalid error
          throw new _errors.AuthenticationTokenInvalidError();
        }
      }

      return userAuth;
    }

    // Deprecated, use user instead

  }, {
    key: 'session',
    value: function session(request) {
      if (request.session.auth) {
        return request.session.auth;
      }
      return false;
    }
  }, {
    key: 'unauthenticate',
    value: function unauthenticate(_ref4, request) {
      var role = _ref4.role;

      if (request.session.auth) {
        request.session.auth = false;
      }
    }
  }, {
    key: 'checkAuthentication',
    value: function checkAuthentication(_ref5, request) {
      var _this = this;

      var modelName = _ref5.modelName,
          resolverName = _ref5.resolverName;

      var tokenConfig = this.config.token || {};
      var authorization = request.headers['authorization'];

      var userAuth = this.user(request);

      return new Promise(function (resolve, reject) {
        var userRole = userAuth.role || 'anonymous';

        var fullResolverName = [modelName, resolverName].join('.');

        if (!modelName) {
          // if no modelname present, this can happen with _meta and other possible internal types
          fullResolverName = resolverName;
        }

        var roleAcl = _this.config.acl[userRole];

        if (roleAcl && (roleAcl.includes(fullResolverName) || roleAcl.includes('*') || roleAcl.includes([modelName, '*'].join('.')))) {
          resolve();
        } else {
          if (userRole === 'anonymous') {
            reject(new _errors.AuthenticationRequiredError());
          } else {
            reject(new _errors.ForbiddenError());
          }
        }
      });
    }
  }]);

  return Authenticator;
}();

exports.default = Authenticator;