# @jimenezraul/auth

> Auth is a module that allows you to authenticate users

Latest version **1.4.0** (published 2023-02-13) · ISC license · 0 weekly downloads

## Install

```sh
npm install @jimenezraul/auth
pnpm add @jimenezraul/auth
yarn add @jimenezraul/auth
bun add @jimenezraul/auth
```

## Health

**Score 25/100 (F)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.4.0 |
| Published | 2023-02-13 |
| First published | 2023-01-21 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | bundled |
| Module format | CommonJS |
| Dependencies | 3 |
| Unpacked size | 229.2 KB |
| Known vulnerabilities | 0 (+3 in 1 direct dependencies) |
| Install scripts | no |
| GitHub stars | 0 |
| Author | Raul Jimenez |
| Maintainers | jimenezraul |
| Keywords | Auth, Authentication, Login, Server authentication, Server login, Express auth |

## Links

- npm: https://www.npmjs.com/package/@jimenezraul/auth
- Repository: https://github.com/jimenezraul/Auth
- Homepage: https://github.com/jimenezraul/Auth#readme
- Issues: https://github.com/jimenezraul/Auth/issues
- npm.io page: https://npm.io/package/@jimenezraul/auth

## Dependencies (3)

- [bcrypt](https://npm.io/package/bcrypt.md) ^5.0.0
- [dotenv](https://npm.io/package/dotenv.md) ^16.0.0
- [jsonwebtoken](https://npm.io/package/jsonwebtoken.md) ^8.5.1

## Alternatives

- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads
- [escher-request](https://npm.io/package/escher-request.md) — 545 weekly downloads

## Recent versions

- 1.4.0 (latest) — 2023-02-13
- 1.3.3 — 2023-01-24
- 1.3.2 — 2023-01-23
- 1.3.1 — 2023-01-23
- 1.3.0 — 2023-01-23
- 1.2.8 — 2023-01-23
- 1.2.7 — 2023-01-23
- 1.2.6 — 2023-01-23
- 1.2.5 — 2023-01-23
- 1.2.4 — 2023-01-23
- 1.2.3 — 2023-01-23
- 1.2.2 — 2023-01-23
- 1.2.1 — 2023-01-23
- 1.2.0 — 2023-01-23
- 1.1.3 — 2023-01-22
- … 14 more at https://npm.io/package/@jimenezraul/auth/versions

## README

<p align="center">
    <img src="./img/auth-logo.png" alt="Parsifal logo" width="250">
</p>

## Description

This is a Auth module that provides a simple way to check if a user is authenticated. Every route that you want to protect you check if a user is passed in the request object. If the user is not passed, it means that the token is not valid or the user has not been authenticated yet. It also provides a middleware to check if the origin of the request is allowed. If the access_token is expired, it will generate a new access token if the refresh token is valid.

Some other functionalities are:

- Auth
  - `auth`
  - `generateToken`
  - `credentials`
  - `validateToken`
- Cookies
  - `getCookie`
  - `getSignedCookie`
  - `setCookie`
  - `removeCookie`

## Table of Contents

- [Description](#description)
- [Table of Contents](#table-of-contents)
- [Installation](#installation)
- [Usage](#usage)
- [Adding middleware to the express app](#adding-middleware-to-the-express-app)
- [Generate Access Token and Refresh Token](#generate-access-token-and-refresh-token)
- [Validate Token](#validate-token)
- [How to use Cookies](#how-to-use-cookies)
- [How to use signed cookies](#how-to-use-signed-cookies)
- [License](#license)
- [Author](#author)
- [Website](#website)

## Installation

```bash
npm i @jimenezraul/auth
```

or

```bash
yarn add @jimenezraul/auth
```

## Usage

Create a .env file in the root folder and add the following code:

```bash
ACCESS_TOKEN_SECRET=your_access_token_secret
REFRESH_TOKEN_SECRET=your_refresh_token_secret
```

Create a file called `allowedOrigins.js` in the config folder and add the allowed origins. This is used to check if the origin of the request is allowed. You can add localhost for development and the production url for production.

```javascript
const allowedOrigins = [
  'http://localhost:3000', // Add as many origins as you want
];

module.exports = allowedOrigins;
```

Create another file called `auth.js` in the middleware folder and add the following code:

```javascript
const allowedOrigins = require('../config/allowedOrigins'); // List of allowed origins
const { Auth } = require('@jimenezraul/Auth'); // Auth module

const authMiddleware = new Auth('15m', '7d', allowedOrigins); // Initialize Auth module with (access token expiration time, refresh token expiration time, allowed origins)

module.exports = authMiddleware;
```

## Adding middleware to the express app

In the `server.js` file, add the following code:

```javascript
const authMiddleware = require('./middleware/auth'); // Auth middleware

// add the middleware after initializing the express app
app.use(authMiddleware.credentials);
app.use(authMiddleware.auth);
```

Now every route that you want to protect you check if a user is passed in the request object. If the user is not passed, it means that the token is not valid.

```javascript
app.get('/api/v1/protected', (req, res) => {
  if (req.user) {
    res.status(200).json({ message: 'You are authenticated' });
  } else {
    res.status(401).json({ message: 'You are not authenticated' });
  }
});
```

## Generate Access Token and Refresh Token

In the `routes.js` file, add the following code:

```javascript
const authMiddleware = require('./middleware/auth');

app.post('/api/v1/login', (req, res) => {
  const { username, password } = req.body;

  // Check if the username and password are correct
  if (username === 'admin' && password === 'admin') {
    const user = {
      username: 'admin',
      role: 'admin',
    };

    tokenNames = ['access_token', 'refresh_token'];

    tokenArray = [];
    // Generate Access Token and Refresh Token
    tokenNames.forEach((tokenName) => {
      const token = authMiddleware.generateToken(user, tokenName);
      tokenArray.push(token);
    });

    res
      .status(200)
      .json({ access_token: tokenArray[0], refresh_token: tokenArray[1] });
  } else {
    res.status(401).json({ message: 'Invalid credentials' });
  }
});
```

## Validate Token

In the `routes.js` file, add the following code:

```javascript
const authMiddleware = require('./middleware/auth');

app.post('/api/v1/refresh', (req, res) => {
 // check if the refresh token is passed in the cookie
  const refreshToken = req.cookies.refresh_token;

  // Validate Refresh Token
  const isValid = authMiddleware.validateToken(refreshToken); // returns true or false

  if(!isValid){
    res.status(401).json({ message: 'Invalid token' });
  } else {
    const user = {
      username: 'admin',
      role: 'admin',
    };

    // Generate Access Token and Refresh Token
    const accessToken = authMiddleware.generateToken(user, "access_token");
    //... rest of the code
  }
```

## How to use Cookies

Create a file called `cookies.js` in the middleware folder and add the following code:

```javascript
const { Cookies } = require('@jimenezraul/Auth'); // Auth module

const cookies = new Cookies(); // Initialize Cookies module

module.exports = cookies;
```

Import the cookies in the `routes.js` file and add the following code:

```javascript
const cookies = require('./middleware/cookies');
const authMiddleware = require('./middleware/auth');

app.post('/api/v1/refresh', (req, res) => {
  // check if the refresh token is passed in the cookie
  const refreshToken = req.cookies.refresh_token;

  // Validate Refresh Token
  const isValid = authMiddleware.validateToken(refreshToken); // returns true or false

  if (!isValid) {
    res.status(401).json({ message: 'Invalid token' });
  } else {
    // Get the user from the database that matches that refresh token
    const user = {
      username: 'admin',
      role: 'admin',
    }; // example of a user object

    const tokens = ['access_token', 'refresh_token'];

    let tokenArray = [];

    // Generate Access Token and Refresh Token
    tokens.forEach((tokenName) => {
      const token = authMiddleware.generateToken(user, tokenName); // generate a token
      tokenArray.push(token); // add the token to the array
      cookies.setCookie(res, tokenName, token); // set the cookie
    });

    res
      .status(200)
      .json({ access_token: tokenArray[0], refresh_token: tokenArray[1] });
  }
});
```

## How to use signed cookies

To sign the cookies you have to install the `cookie-parser` package:

```bash
npm install cookie-parser
```

Set the secret in the `server.js` file:

```javascript
const cookieParser = require('cookie-parser');

// add the cookie parser after initializing the express app
app.use(cookieParser('yoursecret'));
```

Now you can use the signed cookies:

```javascript
const cookies = require('./middleware/cookies');

app.post('/api/v1/refresh', (req, res) => {
  // Now you can use the signed cookies
  const refreshToken = cookies.getSignedCookie(req, 'refresh_token');

  // rest of the code
});
```


## License

[ISC](https://opensource.org/licenses/ISC)

## Author

Raul Jimenez

## Website

[RaulWebDev.com](https://raulwebdev.com)

---
_Source: https://npm.io/package/@jimenezraul/auth · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._