How to implement authentication in mgzon?

[4gels]

I'm building an API using mgzon and I need to add JWT authentication. The docs mention middleware support but I couldn't find a complete example.

What I tried:

• Adding a custom middleware function
• Returning an error when token is missing

What I expected:

• The middleware should block unauthorized requests
• Authenticated users should proceed normally

Question:
Could someone share a working example of JWT authentication with mgzon middleware? Also, how to access the authenticated user inside route handlers?

Thank you.

[Mark-Lasfar]

@4gels Great question! Here's a complete, working example of JWT authentication with mgzon middleware, including how to access the authenticated user in your route handlers.

🔐 Complete JWT Authentication Example

1. Install the required dependency

npm install jsonwebtoken

2. Create the authentication middleware

// middleware/auth.js
const jwt = require('jsonwebtoken');

const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key';

function authMiddleware(req, res, next) {
  // Get token from Authorization header
  const authHeader = req.headers.authorization;
  const token = authHeader?.split(' ')[1]; // Format: "Bearer <token>"

  if (!token) {
    // Return an error response — mgzon will handle it
    return next(new mgzon.errors.Unauthorized('Missing authentication token'));
  }

  try {
    // Verify the token
    const decoded = jwt.verify(token, JWT_SECRET);
    
    // ✅ Attach the user object to the request
    req.user = decoded;
    
    // ✅ IMPORTANT: Call next() to proceed to the route handler
    next();
  } catch (error) {
    if (error.name === 'TokenExpiredError') {
      return next(new mgzon.errors.Unauthorized('Token expired'));
    }
    return next(new mgzon.errors.Forbidden('Invalid token'));
  }
}

module.exports = authMiddleware;

3. Apply middleware to your routes

// app.js or routes/index.js
const mgzon = require('mgzon');
const authMiddleware = require('./middleware/auth.js');

// Apply middleware to a specific route
app.get('/protected-route', authMiddleware, (req, res) => {
  // ✅ Access the authenticated user here
  const userId = req.user.userId;
  res.json({ message: `Hello user ${userId}, you're authenticated!` });
});

// Apply middleware to a group of routes
app.use('/api', authMiddleware);
app.get('/api/profile', (req, res) => {
  res.json({ user: req.user });
});

4. Generate a JWT token (e.g., in a login route)

const jwt = require('jsonwebtoken');

app.post('/login', async (req, res) => {
  const { username, password } = req.body;
  
  // Validate credentials (check your database)
  const user = await authenticateUser(username, password);
  
  if (!user) {
    throw new mgzon.errors.Unauthorized('Invalid credentials');
  }
  
  // Generate token
  const token = jwt.sign(
    { userId: user.id, username: user.username },
    JWT_SECRET,
    { expiresIn: '1h' }
  );
  
  res.json({ token });
});

5. Example API call

# Login to get a token
curl -X POST http://localhost:3000/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"pass"}'

# Call protected endpoint with the token
curl http://localhost:3000/protected-route \
  -H "Authorization: Bearer <your-token>"

📝 Key Takeaways

What you asked	How to do it
Block unauthorized requests	The middleware calls next(error) which sends an Unauthorized response automatically.
Access user inside route handler	Use req.user after the middleware runs.
Return custom errors	Use mgzon.errors.Unauthorized or mgzon.errors.Forbidden.

⚡ Pro Tips

• Store JWT_SECRET in environment variables (never hardcode it).
• For production, use a proper secret rotation strategy.
• Consider adding refresh tokens for better security.
• The req.user object is available in all subsequent middleware and route handlers.

Let me know if you'd like a more advanced example (refresh tokens, role-based auth, or integrating with a database)!