coco-the-bear-auth-sessiontoken/src/authentication.js

A route handler for CoCo The Bear that enforces session token authentication and authorization.

// Using let so rewire can replace this dependancy when testing.
/* eslint-disable prefer-const */
let cookieParser = require('cookie-parser');
let expressSession = require('express-session');
let passport = require('passport');
/* eslint-enable prefer-const */
const unauthorizedError = require('@dannybster/coco-the-bear-http-errors').unauthorized;

const extraOptions = {
  resave: false,
  saveUninitialized: false,
};

function configureExpressSessionMiddleware(options) {
  const sessionOptions = Object.assign({}, options, extraOptions);
  return expressSession(sessionOptions);
}

function serializeUser(user, callback) {
  callback(null, user);
}

function setUp(options) {
  passport.deserializeUser(serializeUser);
  passport.serializeUser(serializeUser);
  return [
    configureExpressSessionMiddleware(options),
    passport.initialize(),
    passport.session(),
    cookieParser(),
  ];
}

function authenticateRequest(req, res, next) {
  const session = req.cookies['connect.sid'];

  function sessionAuthenticationError() {
    const info = { cookies: req.cookies };

    let message;
    let body;
    if (session) {
      body = { message: 'Session token present at connect.sid is invalid' };
      message = 'Invalid session token provided.';
    } else {
      body = { message: 'Session token not present at connect.sid' };
      message = 'No session token provided.';
    }

    const error = unauthorizedError.createError(message, info, body);
    return error;
  }

  function sessionAuthenticatedEvent() {
    return {
      message: 'A session token was authenticated. See the object for more information',
      object: {
        session,
        user: req.user,
      },
    };
  }

  if (req.user) {
    req.body.auth = {
      user: req.user,
    };
    next();
    req.events.emitter.emit('app-event', sessionAuthenticatedEvent());
  } else {
    const error = sessionAuthenticationError();
    next(error);
    req.events.emitter.emit('error', error);
  }
}

module.exports.deserializeUser = serializeUser;
module.exports.extraOptions = extraOptions;
module.exports.authenticateRequest = authenticateRequest;
module.exports.serializeUser = serializeUser;
module.exports.setUp = setUp;