Token-based authentication #

import jwt from "jsonwebtoken";
import crypto from "crypto";

export const genKeyPairRSA = () => {
	try {
		const { privateKey, publicKey } = crypto.generateKeyPairSync("rsa", {
			modulusLength: 4096,
			publicKeyEncoding: {
				type: "pkcs1",
				format: "pem",
			},
			privateKeyEncoding: {
				type: "pkcs1",
				format: "pem",
			},
		});
		return { privateKey, publicKey };
	} catch (error) {
		throw new Error("crypto.generateKeyPairSync got error");
	}
};

export const createTokenPair = (payload, privateKey) => {
	try {
		const accessToken = jwt.sign(payload, privateKey, {
			algorithm: "RS256",
			expiresIn: "60000", // 1min
		});
		const refreshToken = jwt.sign(payload, privateKey, {
			algorithm: "RS256",
			expiresIn: "7 days",
		});

		return { accessToken, refreshToken };
	} catch (error) {
		throw new Error("jwt.sign got error");
	}
};

export const authentication = async (req, res, next) => {
	const userId = req.headers[HEADER.CLIENT_ID];
	if (!userId) {
		throw new AuthFailureError("Invalid request");
	}

	const keyStore = await KeyTokenService.findByUserId(userId);
	if (!keyStore) {
		throw new NotFoundError("Not found any keys and token match this user");
	}

	const refreshToken = req.headers[HEADER.REFRESHTOKEN];
	if (refreshToken) {
		try {
			const decodeUser = jwt.verify(refreshToken, keyStore.publicKey);
			if (userId !== decodeUser.userId) {
				throw new AuthFailureError("Invalid userId");
			}
			req.user = decodeUser; // {userId, email}
			req.refreshToken = refreshToken;
			return next();
		} catch (error) {
			throw error;
		}
	}

	const accessToken = req.headers[HEADER.AUTHORIZATION];
	if (!accessToken) throw new AuthFailureError("Invalid request");

	try {
		const decodeUser = jwt.verify(accessToken, keyStore.publicKey);
		if (userId !== decodeUser.userId) {
			throw new AuthFailureError("Invalid userId");
		}
		req.user = decodeUser; // {userId, email}
		return next();
	} catch (error) {
		throw error;
	}
};

import bcrypt from "bcrypt";

import KeyTokenService from "./keyToken.service.js";
import { createTokenPair, genKeyPairRSA } from "../auth/authUtils.js";


class AccessService {
	static login = async ({ email, password }) => {
		const foundUser = await findByEmail({ email });
		if (!foundUser) {
			throw new BadRequestError("User not yet registered");
		}
		const match = await bcrypt.compare(password, foundUser.password);
		if (!match) {
			throw new AuthFailureError("Authentication error");
		}

		const { privateKey, publicKey } = genKeyPairRSA();

		const { _id: userId } = foundUser;

		const tokens = createTokenPair({ userId, email }, privateKey);

		await KeyTokenService.createKeyToken({
			userId,
			publicKey,
			privateKey,
			refreshToken: tokens.refreshToken,
		});

		return {
			user: foundUser,
			tokens,
		};
	};

	static handleRefreshToken = async ({ refreshToken, user }) => {
		const { userId, email } = user;
		const keyStore = await KeyTokenService.findByUserId(userId);

		if (keyStore.refreshTokensUsed.includes(refreshToken)) {
			await KeyTokenService.removeByUserId(userId);
			throw new ForbiddenError("Something wrong happen. Pls relogin");
		}

		if (keyStore.refreshToken !== refreshToken) {
			throw new AuthFailureError("Token is deleted or never exist");
		}

		const foundUser = await findByEmail({ email });
		if (!foundUser) {
			throw new AuthFailureError("User is deleted or never exist");
		}

		const newTokens = createTokenPair(
			{ userId: foundUser._id, email },
			keyStore.privateKey
		);

		await KeyTokenService.updateRefreshToken(
			userId,
			newTokens.refreshToken,
			refreshToken
		);

		return {
			user,
			tokens: newTokens,
		};
	};
}

export default AccessService;

import { CREATED, SuccessResponse } from "../core/success.response.js";
import AccessService from "../services/access.service.js";

class AccessController {
	login = async (req, res, next) => {
		new SuccessResponse({
			metatdata: await AccessService.login(req.body),
		}).send(res);
	};

	handleRefreshToken = async (req, res, next) => {
		new SuccessResponse({
			message: "Update token success",
			metatdata: await AccessService.handleRefreshToken({
				refreshToken: req.refreshToken,
				user: req.user,
			}),
		}).send(res);
	};
}

export default new AccessController();

import express from "express";

import accessController from "../../controllers/access.controller.js";
import postController from "../../controllers/post.controller.js";
import { authentication } from "../../auth/authUtils.js";

const router = express.Router();

const asyncHandler = (fn) => {
	return (req, res, next) => {
		fn(req, res, next).catch(next);
	};
};

router.post("/user/login", asyncHandler(accessController.login));

// Authenticate before using restricted resources
router.use(asyncHandler(authentication));

router.post("/user/handleRefreshToken", asyncHandler(accessController.handleRefreshToken));
router.post("", asyncHandler(postController.createPost));
router.patch("/:postId", asyncHandler(postController.updatePost));
router.get("/drafts/all", asyncHandler(postController.findAllDraftsOfUser));