@@ -4,7 +4,7 @@ const jwt = require('jsonwebtoken')
44// const uuid = require('uuid/v4')
55// const qrcode = require('qrcode')
66const { USE_OTP , OTP_EXPIRY , HTTPONLY_TOKEN , AUTH_USER_STORE , AUTH_USER_STORE_NAME } = global . CONFIG
7- const { AUTH_USER_FIELD_LOGIN , AUTH_USER_FIELD_PASSWORD , AUTH_USER_FIELD_GAKEY , AUTH_USER_FIELD_ID_FOR_JWT , AUTH_USER_FIELD_GROUPS_FOR_JWT } = global . CONFIG
7+ const { AUTH_USER_FIELD_LOGIN , AUTH_USER_FIELD_PASSWORD , AUTH_USER_FIELD_GAKEY , AUTH_USER_FIELD_ID_FOR_JWT , AUTH_USER_FIELDS_JWT_PAYLOAD = '' } = global . CONFIG
88const { JWT_ALG , JWT_SECRET , JWT_EXPIRY , JWT_REFRESH_EXPIRY , JWT_REFRESH_STORE = 'keyv' , jwtCerts } = global . CONFIG
99
1010const mongo = require ( '../services/db/mongodb' )
@@ -82,13 +82,13 @@ const authUser = async (req, res, next) => {
8282 if ( req . baseUrl + req . path === '/api/auth/refresh' ) {
8383 try {
8484 // check refresh token & user - always stateful
85- const { id, groups , exp } = jwt . decode ( token )
85+ const { id, exp , iat , verified , ... payload } = jwt . decode ( token )
8686 let refreshToken = await getToken ( id )
8787 if ( refreshToken ) {
8888 // console.log('ggg', req.baseUrl, req.path, parseInt(Date.now() / 1000) - exp, JWT_REFRESH_EXPIRY, e.toString(), parseInt(Date.now() / 1000) < exp + JWT_REFRESH_EXPIRY, token)
8989 if ( parseInt ( Date . now ( ) / 1000 ) < exp + JWT_REFRESH_EXPIRY ) { // not too expired... exp is in seconds, iat is not used
9090 if ( refreshToken === req . body . refresh_token ) { // ok... generate new access token & refresh token?
91- const tokens = await createToken ( { id, verified : true , groups } , { expiresIn : JWT_EXPIRY } ) // 5 minute expire for login
91+ const tokens = await createToken ( { id, verified : true , ... payload } , { expiresIn : JWT_EXPIRY } ) // 5 minute expire for login
9292 if ( HTTPONLY_TOKEN ) res . setHeader ( 'Set-Cookie' , [ `token=${ tokens . token } ] ) ; // may need to restart browser, TBD set Max-Age, ALTERNATE use res.cookie, Signed?, Secure?, SameSite=true?
9393 return res . status ( 200 ) . json ( tokens )
9494 }
@@ -133,11 +133,22 @@ const refresh = async (req, res) => {
133133 return res . status ( 401 ) . json ( { message : 'Error token revoked' } )
134134}
135135
136+ const addPayloadFromUserData = ( user ) => { // local method
137+ const keys = AUTH_USER_FIELDS_JWT_PAYLOAD . split ( ',' )
138+ const payloadItems = { }
139+ if ( keys && keys . length ) {
140+ for ( const key of keys ) {
141+ if ( key && user [ key ] !== undefined ) payloadItems [ key ] = user [ key ]
142+ }
143+ }
144+ return payloadItems
145+ }
146+
136147const login = async ( req , res ) => {
137148 try {
138149 // console.log(AUTH_USER_FIELD_LOGIN, req.body)
139150 const user = await findUser ( {
140- [ AUTH_USER_FIELD_LOGIN ] : req . body [ AUTH_USER_FIELD_LOGIN ] // email
151+ [ AUTH_USER_FIELD_LOGIN ] : req . body [ AUTH_USER_FIELD_LOGIN ]
141152 } )
142153 const password = req . body [ AUTH_USER_FIELD_PASSWORD ]
143154
@@ -146,7 +157,8 @@ const login = async (req, res) => {
146157 if ( user . revoked ) return res . status ( 401 ) . json ( { message : 'Authorization Revoked' } )
147158 let verified = true
148159 const id = user [ AUTH_USER_FIELD_ID_FOR_JWT ] || ''
149- const groups = user [ AUTH_USER_FIELD_GROUPS_FOR_JWT ] || ''
160+ const additionalPayload = addPayloadFromUserData ( user )
161+
150162 if ( ! id ) return res . status ( 401 ) . json ( { message : 'Authorization Format Error' } )
151163 if ( USE_OTP ) {
152164 verified = false
@@ -158,7 +170,7 @@ const login = async (req, res) => {
158170 // // set user SMS & send it
159171 // }
160172 }
161- const tokens = await createToken ( { id, verified, groups } , { expiresIn : USE_OTP ? OTP_EXPIRY : JWT_EXPIRY } ) // 5 minute expire for login
173+ const tokens = await createToken ( { id, verified, ... additionalPayload } , { expiresIn : USE_OTP ? OTP_EXPIRY : JWT_EXPIRY } ) // 5 minute expire for login
162174 if ( HTTPONLY_TOKEN ) res . setHeader ( 'Set-Cookie' , [ `token=${ tokens . token } ] ) ; // may need to restart browser, TBD set Max-Age, ALTERNATE use res.cookie, Signed?, Secure?, SameSite=true?
163175 return res . status ( 200 ) . json ( tokens )
164176 } catch ( e ) {
@@ -169,15 +181,16 @@ const login = async (req, res) => {
169181
170182const otp = async ( req , res ) => { // need to be authentication, body { pin: '123456' }
171183 try {
172- const { id, groups } = req . decoded
184+ const { id } = req . decoded
173185 const user = await findUser ( { id } )
174186 if ( user ) {
175187 const { pin } = req . body
176188 const gaKey = user [ AUTH_USER_FIELD_GAKEY ]
177189 const isValid = USE_OTP !== 'TEST' ? otplib . authenticator . check ( pin , gaKey ) : String ( pin ) === '111111'
178190 if ( isValid ) {
179191 await revokeToken ( id )
180- const tokens = await createToken ( { id, verified : true , groups } , { expiresIn : JWT_EXPIRY } )
192+ const additionalPayload = addPayloadFromUserData ( user )
193+ const tokens = await createToken ( { id, verified : true , ...additionalPayload } , { expiresIn : JWT_EXPIRY } )
181194 if ( HTTPONLY_TOKEN ) res . setHeader ( 'Set-Cookie' , [ `token=${ tokens . token } ] ) ; // may need to restart browser, TBD set Max-Age, ALTERNATE use res.cookie, Signed?, Secure?, SameSite=true?
182195 return res . status ( 200 ) . json ( tokens )
183196 } else {
@@ -248,4 +261,4 @@ console.log('Encrypted: ' + encText)
248261
249262const decText = decryptText(algorithm, key, iv, encText, 'base64')
250263console.log('Decrypted: ' + decText);
251- */
264+ */
0 commit comments