Where to set security scheme to enable auth token to be sent

[Morriz]

Just a question

[Morriz]

I have now got it working with auth, through trial and error, like this:

In the {service}/index.js file I have this section:

const _service = service(options);
  _service.docs = {
    securities: ['create', 'update', 'patch', 'remove']
  };
  app.use('/activity', _service);

but this seems redundant, as that information is given by setting the restrictToAuthenticated hooks. Can those calls not 'inflect' where they come from and set this information automatically?

[daffl]

Not at the moment since hooks don't add any additional information in to the service. Another way might be to set it globally as done in the Sequelize example in https://github.com/feathersjs/feathers-swagger/blob/master/example/sequelize/app.js#L52-L63

[idealley]

I got the security to work for the documentation as follow:

in app.js I configure swagger (in a module to simplify the code):

   const swOptions = require('./swagger/swagger');
   ...
   app.use()
   ...
  .configure(swagger(swOptions))

The module is configured as follow:

module.exports = {
    docsPath: '/docs',
    uiIndex: path.join(__dirname, 'docs.html'),
    info: {
      title: 'Title of the Documentation',
      description: 'Available endpoints'
    },
    securityDefinitions: {
      bearer: {
        type: "apiKey",
        name: "authorization",
        in: "header"
      }
    },
    security: [
      {
        bearer: []
      }
    ]
};

You need to set the 'securityDefinisions' and the security array as far as I am using the default authorization of feathers I need to say that I will be sending a bearer token. I define what is the bearer for the swagger UI to be able to generate the correct buttons (authorize one).

Then per service I can now set per route if this route needs authorization or not. So when you instantiate a service, you need:

  // Initialize our service with any options it requires
  app.use('/users', Object.assign(service(options), {
      docs: def
    })); 

I am passing a definition which allows: custom description of the endpoint, to add params definition, examples etc.

For example if you want to limit a create route to authorized users:

module.exports = {
  description: 'Users of the API (requires administrator role)',
  find: {
  },
  get: {
  },
  create: {
    security: [    {
      bearer: []
    }]
  },
  update: {
  },
  patch: {
  },
  remove: {
  }
};

As far as security is an array you can pass it other security strategies and of course you can pass other objects for each method here is another example with method definition:

const params = require('./parameters');

module.exports = {
  description: 'ERS Articles',
  find: {
    security: [    {
      bearer: []
    }],
    description: 'Get articles relative to a node with the node', 
    summary: 'Returns the category (node) and its outgoing relatives with the association ers:article',parameters: [
        params.qname,
        params.limit,
        params.skip
    ],
    responses: {
      "200": {
            description: 'successful operation',
            schema: {
              type: "object",
              example:
                {
                    "data": [],
                    "category": [],
                    "_sys": {
                        "next": 'string',
                        "prev": 'string'
                    },
                    "limit": 'int',
                    "skip": 'int',
                    "total": "coming soon"
                }
              
            },
      },
      "404": {
            description: 'not found',
            schema: {
              type: "string"
            }
      }
    },
    produces: ["application/json"]
  }
};

I have externalised the params as I need to reuse the same one on other services.

I hope this configuration may help someone ;) as it did not work right away... some trial and error involved...

[Mairu]

Example of authentication configuration was added to the repository.

[gauravbhusare]

I am not able to get that authorize button on top

I have added
securityDefinitions: { bearer: { type: "apiKey", name: "authorization", in: "header" } }, security: [ { bearer: [] } ]
above code.

[Mairu]

See https://github.com/feathersjs-ecosystem/feathers-swagger/blob/master/example/swagger-v2/security.js for a working example.

You also have to define the securities for the services.

[gauravbhusare]

Thank you so much @Mairu