jrfjwt v1.0.0

JRFJWT

jrfjwt is an async/await package for working with JWT. The functional uses one of PostgreSQL or MongoDB DBMS. Work with tokens is conducted in the context of User, Device.

installation

$ nmp -i jrfjwt

Token content

access and refresh tokens contain

• head head: {alg, typ}

  Name	Type	Description
  alg	string	Encryption algorithm
  typ	string	Token type

• payload head: {userId, rolesId, devId, iss, exp}

  Name	Type	Description
  userId	string	user id
  rolesId	array of string	user role id
  devId	string	user device id
  iss	string	ID of the token-generating side
  exp	number	Token lifetime

methods

constructor()

Just creates an object const jrfjwt = new JRFJWT();

init(options)

Initialization let res = await jrfjwt.init(options)

• Options - the jrfjwt setting consists of the db database setting and token token setting. You can initialize without options, then the default settings will be applied.

• db

• token

• Example

    const JRFJWT = require('jrfjwt');
    const jrfjwt = new JRFJWT();
    
    let res = await jrfjwt.init({
        db: {
            type: jrfjwt.dbType.PostgreSQL,
            server: 'localhost',
            port: 5432,
            db: 'jrfjwt_test',
            user: 'jrfjwttest',
            password: '12345678'
        },
        token: {
            alg: 'HS512',
            typ: 'JWT',
            iss: '',
            accessExp: '10min',
            refreshExp: '10day',
            salt: 'J*$#d73',
            iterations: 100,
            hashLength: 64
        }
    });

• Response - If it was not possible to connect to the database, a 'not init jrfjwt' exception will be thrown.

addNewUser(user)

Add a new user to the database of tokens.

• user

• Example

    let res = await jrfjwt.addNewUser({
        userId: 'morty',
        rolesId: ['yong', 'foreveryong']
    });

• Response

addNewUsers(users)

Add new users to the database of tokens.

• users - array containing users

• user

• Example

    let res = await jrfjwt.addNewUsers([
        {
            userId: 'morty',
            rolesId: ['yong', 'foreveryong']
        },
        {
            userId: 'rick',
            rolesId: ['space', 'superspace']
        }
    ]);

• Response

• res add user

getUsers(id)

Get users, if id is not passed, all users are returned.

• id

• Example

    let res = await jrfjwt.getUsers();

• Response

• user

• token

[ { userId: 'morty',
       rolesId: [ 'yong', 'foreveryong' ],
       tokens:
        [ { devId: 'blaster',
            access: 'accessToken1',
            refresh: 'refreshToken1' },
          { devId: 'laser',
            access: 'accessTokenLaser',
            refresh: 'refreshTokenLaser' },
          { devId: 'loser',
            access: 'accessTokenLoser',
            refresh: 'refreshTokenLoser' } ],
       tokensOld:
        [ { devId: 'blaster',
            access: 'accessToken1Old',
            refresh: 'refreshToken1Old' },
          { devId: 'laser',
            access: 'accessTokenLaserOld',
            refresh: 'refreshTokenLaserOld' },
          { devId: 'Cheat',
            access: 'accessTokenCheaatOld',
            refresh: 'refreshTokenCheatOld' } ] } ]

updateRoles(userId, rolesId)

Update user roles

• Example

    let res = await jrfjwt.getUsers('morty', ['user', 'guest']);

• Response

delUsers(id)

Delete user, if id is not passed, all users are deleted.

• id

• Example

    let res = await jrfjwt.delUsers();

• Response

createTokens(userId)

Create a new token for user

• Example

    let res = await jrfjwt.createTokens('morty');

• Response

• token

updateTokens(userId, devId)

Update (reissue) user token for device.

• Example

    let res = await jrfjwt.updateTokens('morty', 'DKO32LS');

• Response

• token

delTokens(userId, devId)

Delete user device token.

• Example

    let res = await jrfjwt.delTokens('morty', 'DKO32LS');

• Response

delAllTokens(userId)

Delete all user tokens.

• Example

    let res = await jrfjwt.delAllTokens('morty');

• Response

isValid(access, refresh, rolesRules, usersRules)

Check token for validity. Check user access rights.

• rolesRules

• usersRules

• Example

const rolesRules = {
            exclude: ['superuser'],
            include: [],
            defaultAccess: false
        };
let res = await token.isValid({access, refresh, rolesRules});

• Logic

  • Tokens are decoded; if decode failed, then return res.description = 'invalid'
  • The access token's signature is checked, if the signature is not valid, then return res.description = 'access signature invalid'
  • The refresh token's signature is checked, if the signature is not valid, then the return is res.description = 'refresh signature invalid'
  • Search user userId in the database, if the user is not found, then returnres.description = 'not found user'

  • Search access andrefresh tokens from user by devId.

    At one time, a user by devId can have only one valid token (token: {devId, access, refresh}) and one obsolete/previous token (tokenOld: {devId, access, refresh}).

    If the access andrefresh tokens are not found in the token and tokenOld, then return res.description = 'tokens not found', the tokens by userId, devId are removed

  • If the access and refresh tokens were found in tokenOld, then tokenOld is deleted, and access and refresh take on the value from token (token: {devId, access, refresh} tokenOld : {}).

  • It checks the lifetime of the refresh token, if the lifetime has expired, then return res.description = 'refresh token not live', tokens are deleted by userId, devId
  • The access time of the access token is checked, if the lifetime has expired, the user creates a new token: {devId, access, refresh}, removes tokenOld: {}, the current access and refresh tokens are placed in tokenOld: {devId, access, refresh}. A new token is passed in the response res.tokensNew. If an error occurred while updating the token, then return res.description = 'server error, repeat pleas'
  • If usersRules was passed, then it is checked whether access is allowed to the user. If userId is found in include, then res.access = true, if userId is found in exclude, then res.access = false, if userId is not found in include and in exclude, then res.access = defaultAccess. If res.access = false, then return res.description = 'no rights'
  • If rolesRules was passed, then it is checked whether access to the user is allowed by roles. If one of the roles of the user rolesId is found in include, then res.access = true, if one of the user roles of the rolesId is found in exclude, then res.access = false, if none of user roles rolesId not found in include and in exclude, then res.access = defaultAccess. If res.access = false, then return res.description = 'no rights'
  • Return response res

    res = {
        okay: true,
        description: '',
        isValid: true,
        access: true,
        tokensNew: {devId, access, refresh}
    };

• Response