# fastify-authz-auth0

> Auth0 library to get token data and extract roles and permissions

Latest version **1.0.4** (published 2019-09-12) · ISC license · 0 weekly downloads

## Install

```sh
npm install fastify-authz-auth0
pnpm add fastify-authz-auth0
yarn add fastify-authz-auth0
bun add fastify-authz-auth0
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.0.4 |
| Published | 2019-09-12 |
| First published | 2019-09-12 |
| Weekly downloads | 0 |
| License | ISC |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 3 |
| Unpacked size | 9.8 KB |
| Known vulnerabilities | 0 (+11 in 2 direct dependencies) |
| Install scripts | no |
| GitHub stars | 2 |
| Maintainers | harishmatta |

## Links

- npm: https://www.npmjs.com/package/fastify-authz-auth0
- Repository: https://github.com/mattaharish/fastify-authz-auth0
- Homepage: https://github.com/mattaharish/fastify-authz-auth0#readme
- Issues: https://github.com/mattaharish/fastify-authz-auth0/issues
- npm.io page: https://npm.io/package/fastify-authz-auth0

## Dependencies (3)

- [fastify](https://npm.io/package/fastify.md) ^2.8.0
- [jsonwebtoken](https://npm.io/package/jsonwebtoken.md) ^8.5.1
- [fastify-plugin](https://npm.io/package/fastify-plugin.md) ^1.6.0

## Recent versions

- 1.0.4 (latest) — 2019-09-12

## README

# fastify-authz-auth0

This module does not provide an authentication strategy, but it provides an utility to handle authorization in your routes, without adding overhead.

Check out the complete example [here](https://github.com/mattaharish/fastify-authz-auth0/blob/test/src/example.js).

## Install

```
npm i fastify-authz-auth0 --save
```

## Usage

Import this package in your `src/index.js` and register this plugin before registering your API routes.

```js
'use strict';

// Require the auth plugin
const auth = require('fastify-authz-auth0');
const routes = require('./app/v1');

function create() {
  //creates the core fastify server instance with defaults
  const fastify = core.createServer();

  //Register auth plugin before registering routes
  fastify.register(auth);
  
  //custom routes set up
  fastify.register(routes, { prefix: '/v1' });

  return fastify;
}

async function start() {
  const fastify = create();
  core.start(fastify);
}

module.exports = {
  create,
  start
};
```

And when defining API routes, make sure you have a `preHandler` calling this `auth` function, which is decorated to the fastify instance.

Example API `route` definition
```js
  fastify.route({
    method: 'GET',
    url: '/product-types/:productTypeId',
    schema: {
      params: {
        type: 'object',
        properties: {
          productTypeId: { type: 'string', format: 'uuid' }
        }
      },
      response: {
        200: getProductTypeByIdSuccessfulResponse,
        ...errorResponses
      }
    },
    // Pass the array of permissions for this route.
    preHandler: fastify.auth(['read:product-types']),
    handler: getProductTypeByIdHandler(fastify)
  });
```

## Authentication & Authorization

```Authentication confirms user/ service identity to grant access to the system.```

```Authorization determines whether the user/ service has permissions to access the resources.```

```
Auth0 provides authentication and authorization as a service. It takes the overhead of generating accessTokens with the list of permissions based on role of user.
```

The permissions inside the token are embedded like below:
```
...
 "permissions": [
    "read:product-types"
  ]
  ...
  ```


## How this plugin works

1. This plugin will check for `authorization` property containing the value in the form of `Bearer <Token(Generated By Auth0)>` in the request headers or body or query parameters.

2. Then the `token` is decoded using `jsonwebtoken` module and picks the `permissions` array in the token.
3. If the list of `permissions` which are passed, when calling the `auth` function in `preHandler` matches against the `permissions` obtained from the token then the `api` is served otherwise it responds with `403 {UnAuthorized}`


## Acknowledgements

This project is kindly sponsored by:


## License

Licensed under ---

---
_Source: https://npm.io/package/fastify-authz-auth0 · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._