Allow fine-grained user validation in Satellite middleware

[humphd]

In certain places we need to be able to do custom checks against certain claims for the currently authenticated user. An authenticated user sends a JWT bearer token, which includes claims like their id (sub) and their roles, etc.

We need a simple way for microservices to be able to inspect the user's claims, and decide whether or not a user is authorized to make some request.

Satellite already has middleware for doing most of this, but it needs to be extended. Consider:

const { isAuthenticated, isAuthorized } = require('@senecacdot/satellite');
...
router.post(
  '/:id',
  isAuthenticated(),
  isAuthorized({
    authorizeUser(user) {
      // Get the user id for this request
      const id = req.params.id;
      // Check that the id being used on the request matches the authenticated user's sub claim.
      // Also allow an admin user to do this.  We return `true` if this is allowed, `false` otherwise
      return user.sub === id || user.roles.includes('admin')
    }
  }),
  async (req, res, next) => {
    ...
  }
);

Let's add the ability for the isAuthorized() middleware to accept a function called authorizeUser(). If defined, it should get passed the authenticated user (e.g., the decoded payload from the JWT token), and the caller can use that in order to do some comparisons and return true or false. If the function returns true, we allow the request. If false we don't.

[humphd]

Fixing this in DevelopingSpace/satellite#8.