feat: add support for jwt on api #896

juanpicado · 2018-08-05T12:40:33Z

Type: feat
Description:

This PR aims to deprecate AES token generator but without replacing it and allow to use JWT as an alternative on API. (#168 (comment))

Provides customize JWT signature and verification based on
https://github.com/auth0/node-jsonwebtoken#usage

Default Security Config

security:
  api:
    jwt:
      sign:
        expiresIn: 60d
        notBefore: 1
  web:
    sign:
      expiresIn: 7d

Legacy

Legacy refers to the default authentification (#168 (comment)) used by 2.x and 3.x. If you don't define the security block, legacy is being enabled by default.

security:
  api:
    legacy: true
  web:
    sign:
      expiresIn: 7d

.npmrc

//localhost:4873/:_authToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoianVhbjExIiwiZ3JvdXBzIjpbImp1YW4xMSIsIiRhbGwiLCIkYXV0aGVudGljYXRlZCIsIkBhbGwiLCJAYXV0aGVudGljYXRlZCIsImFsbCJdLCJyZWFsX2dyb3VwcyI6WyJqdWFuMTEiXSwiZ3JvdXAiOlsianVhbjExIl0sImlhdCI6MTUzNDAwOTkzOSwibmJmIjoxNTM0MDA5OTM5LCJleHAiOjE1MzQ2MTQ3Mzl9.FPQ__wb-CIT2Gnti0fMyBw6XK20Zv8xuuZBqVVaCr7s

Resolves #168 #729

🆕 enable JWT by default on API.

https://verdaccio.org/blog/2019/04/19/diving-into-jwt-support-for-verdaccio-4

add multiple scenarios with configuration file

#168

juanpicado · 2018-08-14T05:45:30Z

src/api/web/index.js

@@ -15,7 +15,7 @@ const spliceURL = require('../../utils/string').spliceURL;
 module.exports = function(config, auth, storage) {
  Search.configureStorage(storage);

-  router.use(auth.webUIJWTmiddleware());
+  // router.use(auth.webUIJWTmiddleware());


reminder: this is odd

ayusharma · 2018-08-16T08:10:50Z

src/lib/auth-utils.js

+
+    return credentials;
+  } else {
+    return;


No need of return

may be you want it more readable..

ayusharma

Can you replace err with error. I'll run it locally later and give one more review.

ayusharma · 2018-08-16T10:44:49Z

src/lib/crypto-utils.js

+    return jwt.sign(payload, secretOrPrivateKey, {
+      notBefore: '1000', // Make sure the time will not rollback :)
+      ...options,
+    }, (err, token) => {


arrow ===> function expression

ayusharma · 2018-08-16T10:45:19Z

test/lib/server_process.js

@@ -76,7 +76,7 @@ export default class VerdaccioProcess implements IServerProcess {
    });

    this.childFork.on('error', (err) => {
-      console.log('error process', err);
+      // console.log('error process', err);


can we remove it ?

ayusharma · 2018-08-16T10:54:19Z

src/lib/auth-utils.js

+    });
+  } else {
+      // i am wiling to use here _.isNil but flow does not like it yet.
+    if (typeof security.api.jwt !== 'undefined' &&


Destructure...

const {jwt} = security.api;

ayusharma · 2018-08-16T14:54:27Z

src/lib/auth-utils.js

+export function createSessionToken(): CookieSessionToken {
+  return {
+    // npmjs.org sets 10h expire
+    expires: new Date(Date.now() + 10 * 60 * 60 * 1000),


can we have this as a constant somewhere?

ayusharma · 2018-08-16T14:55:35Z

src/lib/auth-utils.js

+}
+
+export function getAuthenticatedMessage(user: string): string {
+  return `you are authenticated as '${user}'`;


Just check ' this in $user

Yes, it's intended. Don't ask me why :-) ... it was there already and unless I know what it does i cannot remove it.

ayusharma · 2018-08-16T14:56:10Z

src/lib/auth-utils.js

+}
+
+export function isAESLegacy(security: Security): boolean {
+  return _.isNil(security.api.legacy) === false &&


Suggestion: destructures..

ayusharma · 2018-08-16T15:02:50Z

src/lib/auth-utils.js

+
+    return credentials;
+  } else {
+    return;


may be you want it more readable..

ayusharma · 2018-08-16T15:03:17Z

src/lib/auth-utils.js

+    if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+        return verifyJWTPayload(token, secret);
+    } else {
+      return;


same here.. return

it was mostly for debugging. Removed

priscilawebdev

Great! Looks fine 👍

I forgot add this before 😷

in case we want more output

juanpicado · 2018-08-21T06:06:05Z

Thanks @priscilawebdev @ayusharma for CR, this is a nice feature.

* feat: add support for jwt on api * test: add unit test for sign token with jwt add multiple scenarios with configuration file * chore: add JWT verification on middleware * chore: restore headless * chore: restore middleware header validation * refactor: fix login whether user exists * refactor: JWT is signed asynchronously * refactor: better structure and new naming convention * test: add unit test for token signature * test: add unit test for creating user with JWT enabled #168 * docs: add security section jwt * refactor: renable web auth middleware * test(auth): add legacy disabled scenario * chore: update gitignore * chore: add some es6 sugar * feat: enable JWT token signature for new installations * chore: add yaml files to git I forgot add this before 😷 * chore: trace log on auth in case we want more output

lock · 2019-01-08T22:26:38Z

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

juanpicado added the WIP label Aug 5, 2018

juanpicado added this to the 4.0.0 milestone Aug 5, 2018

juanpicado changed the base branch from master to 4.x August 5, 2018 13:19

juanpicado force-pushed the feature-168 branch from 271fdf0 to 5800169 Compare August 5, 2018 13:22

feat: add support for jwt on api

ac1936f

juanpicado force-pushed the feature-168 branch from 5800169 to ac1936f Compare August 5, 2018 13:24

verdaccio deleted a comment Aug 5, 2018

test: add unit test for sign token with jwt

f7f978a

add multiple scenarios with configuration file

juanpicado force-pushed the feature-168 branch from 14ae935 to f7f978a Compare August 7, 2018 20:45

juanpicado added 11 commits August 9, 2018 00:55

chore: add JWT verification on middleware

afc3add

chore: restore headless

ab3d2e0

chore: restore middleware header validation

35b546b

refactor: fix login whether user exists

5b68845

Merge branch '4.x' into feature-168

757384a

refactor: JWT is signed asynchronously

db3538d

refactor: better structure and new naming convention

7ecd3a2

test: add unit test for token signature

71eadc1

test: add unit test for creating user with JWT enabled

cf05957

#168

Merge branch '4.x' into feature-168

455107f

docs: add security section jwt

e92fef6

juanpicado added dev: code-review and removed WIP labels Aug 14, 2018

juanpicado requested review from ayusharma, sergiohgz and priscilawebdev August 14, 2018 05:20

juanpicado commented Aug 14, 2018

View reviewed changes

juanpicado added 4 commits August 15, 2018 13:13

refactor: renable web auth middleware

2adc40c

test(auth): add legacy disabled scenario

accc481

chore: update gitignore

930279e

Merge branch '4.x' into feature-168

b3dd01e

juanpicado added this to In Progress in Verdaccio 4 Aug 15, 2018

juanpicado mentioned this pull request Aug 15, 2018

Verdaccio 4.0.0-beta #924

Merged

juanpicado added 2 commits August 15, 2018 18:55

Merge branch '4.x' into feature-168

70d9625

Merge branch '4.x' into feature-168

d72a542

ayusharma reviewed Aug 16, 2018

View reviewed changes

ayusharma requested changes Aug 16, 2018

View reviewed changes

juanpicado added 3 commits August 17, 2018 07:17

chore: add some es6 sugar

17afa1a

Merge branch '4.x' into feature-168

3add507

Merge branch '4.x' into feature-168

53ed916

ayusharma approved these changes Aug 20, 2018

View reviewed changes

Merge remote-tracking branch 'origin/4.x' into feature-168

561bfd3

priscilawebdev approved these changes Aug 20, 2018

View reviewed changes

juanpicado added 3 commits August 21, 2018 07:52

feat: enable JWT token signature for new installations

70f4d73

chore: add yaml files to git

7cafa6e

I forgot add this before 😷

chore: trace log on auth

bf9c4c3

in case we want more output

juanpicado merged commit a68d247 into 4.x Aug 21, 2018

Verdaccio 4 automation moved this from In Progress to Done Aug 21, 2018

delete-merged-branch bot deleted the feature-168 branch August 21, 2018 06:05

juanpicado added topic: feature request and removed dev: code-review labels Aug 21, 2018

juanpicado mentioned this pull request Sep 2, 2018

Update IAuthWebUI flow types #970

Closed

This was referenced Oct 8, 2018

npm token create password (npm token) #541

Closed

Improve token auth #168

Closed

juanpicado mentioned this pull request Jan 2, 2019

[Question] Remove auth token #1169

Closed

lock bot locked as resolved and limited conversation to collaborators Jan 8, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add support for jwt on api #896

feat: add support for jwt on api #896

juanpicado commented Aug 5, 2018 •

edited

juanpicado Aug 14, 2018

ayusharma Aug 16, 2018

ayusharma Aug 16, 2018

ayusharma left a comment

ayusharma Aug 16, 2018

ayusharma Aug 16, 2018

ayusharma Aug 16, 2018

ayusharma Aug 16, 2018

ayusharma Aug 16, 2018

juanpicado Aug 17, 2018

ayusharma Aug 16, 2018

ayusharma Aug 16, 2018

ayusharma Aug 16, 2018

juanpicado Aug 17, 2018

priscilawebdev left a comment

juanpicado commented Aug 21, 2018

lock bot commented Jan 8, 2019

feat: add support for jwt on api #896

feat: add support for jwt on api #896

Conversation

juanpicado commented Aug 5, 2018 • edited

Default Security Config

Legacy

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ayusharma left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

priscilawebdev left a comment

Choose a reason for hiding this comment

juanpicado commented Aug 21, 2018

lock bot commented Jan 8, 2019

juanpicado commented Aug 5, 2018 •

edited