# @gparency/authorizer

> Implementation of authorization logic for the GParency Lambda functions

Latest version **2.2.6** (published 2023-05-29) · MIT license · 0 weekly downloads

## Install

```sh
npm install @gparency/authorizer
pnpm add @gparency/authorizer
yarn add @gparency/authorizer
bun add @gparency/authorizer
```

## Health

**Score 25/100 (F)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 2.2.6 |
| Published | 2023-05-29 |
| First published | 2022-05-09 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Node | =14 |
| Dependencies | 6 |
| Unpacked size | 148.3 KB |
| Known vulnerabilities | 0 (+6 in 3 direct dependencies) |
| Install scripts | no |
| Author | Forwardslash |
| Maintainers | alex-braverman, mordygparency, sasa_andjelic, abrar.qureshi, rmoddel |

## Links

- npm: https://www.npmjs.com/package/@gparency/authorizer
- Repository: https://github.com/gparency/authorizer
- Homepage: https://github.com/gparency/authorizer#readme
- Issues: https://github.com/gparency/authorizer/issues
- npm.io page: https://npm.io/package/@gparency/authorizer

## Dependencies (6)

- [jwt-decode](https://npm.io/package/jwt-decode.md) 3.1.2
- [@nestjs/core](https://npm.io/package/@nestjs/core.md) 8.4.4
- [jsonwebtoken](https://npm.io/package/jsonwebtoken.md) 8.5.1
- [@nestjs/common](https://npm.io/package/@nestjs/common.md) 8.4.4
- [@nestjs/config](https://npm.io/package/@nestjs/config.md) ^2.1.0
- [@gparency/shared](https://npm.io/package/@gparency/shared.md) 1.13.6

## Recent versions

- 2.2.6 (latest) — 2023-05-29
- 2.0.5 (old-version) — 2022-11-17
- 2.2.5 — 2023-04-24
- 2.0.6 — 2023-01-10
- 2.2.4 — 2022-12-30
- 2.2.3 — 2022-11-17
- 2.0.4 — 2022-11-17
- 2.2.2 — 2022-11-17
- 2.2.1 — 2022-11-17
- 2.2.0 — 2022-10-07
- 2.1.5 — 2022-10-03
- 2.1.4 — 2022-07-14
- 2.1.3 — 2022-07-01
- 2.1.2 — 2022-06-30
- 2.1.1 — 2022-06-30
- … 8 more at https://npm.io/package/@gparency/authorizer/versions

## README

# GParency Authorize Decorator
![Release to NPMJS Status](https://github.com/gparency/authorizer/actions/workflows/release.yaml/badge.svg)
[![Npm package version](https://badgen.net/npm/v/@gparency/authorizer)](https://npmjs.com/package/@gparency/authorizer)
[![Minimum node.js version](https://badgen.net/npm/node/@gparency/authorizer)](https://npmjs.com/package/@gparency/authorizer)

## About

This is NPM package containing the `@Authorize` decorator that is used for authorizing access to GParency lambda functions. The authorizer injects the authorized user payload in the `event` if user is authorized.

`requestContext.authorizer` injected into API Gateway `event`:
```json
{
    "loanTrackerId": 123456789, 
    "email": "user@email.com", 
    "isGpPaid": "true | false",  
    "isMapUser": "true | false",  
    "isPaidMapUser": "true | false",  
    "isLenderPaid": "true | false",
    "isLender": "true | false",
    "isAdmin": "true | false",
    "rateAdmin": "true | false",
    "userId": "google-oauth2|103010667649373229274"
}
```

## How to use

1. Install the package

```shell
$ npm install @gparency/authorizer
```

2. Add decorator to handler methods

```typescript
class Handler {
    /**
     * Get Profile
     * @param event APIGatewayProxyEvent
     * @param _context Context
     */
    @Authorize(AuthorizationLevel.IS_GP_PAID)
    public async getProfile(event: APIGatewayProxyEvent, _context: Context): Promise<APIGatewayProxyStructuredResultV2> {
        const service = await this.getService({ event });
        try {
            return GatewayResponse.ok(await service.getProfile());
        } catch (exception) {
            Logger.error(exception);
            return GatewayErrorResponse.fromError(exception);
        }
    }
}
```

## Levels of authorization

There are six levels of authorization:

1. `@Authorize()`: This is only checking if the user is authenticated and has a valid JWT.
2. `@Authorize(AuthorizationLevel.IS_GP_PAID)`: This checks if the user is GP Paid member.
3. `@Authorize(AuthorizationLevel.IS_MAP_USER)`: This checks if the user is registered for the Map.
4. `@Authorize(AuthorizationLevel.IS_PAID_MAP_USER)`: This checks if the user is paid for the Map.
5. `@Authorize(AuthorizationLevel.IS_LENDER_PAID)`: This checks if the user is Lender Paid member.
6. `@Authorize(AuthorizationLevel.IS_LENDER)`: This checks if the user is a Lender member.

## Additional claims:
- userId - Id of the logged in user.

## Required Environment Variables

```dotenv
AUTH0_AUDIENCE="..."
AUTH0_ISSUER="..."
AUTH0_SIGNING_CERT="..."
```

---
_Source: https://npm.io/package/@gparency/authorizer · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._