# postgrest-auth

> Authorization server for postgREST

Latest version **0.0.3** (published 2017-08-06) · MIT license · 0 weekly downloads

## Install

```sh
npm install postgrest-auth
pnpm add postgrest-auth
yarn add postgrest-auth
bun add postgrest-auth
```

Provides the command `postgrest-auth`.

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.0.3 |
| Published | 2017-08-06 |
| First published | 2017-08-05 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 15 |
| Known vulnerabilities | 0 (+17 in 4 direct dependencies) |
| Install scripts | no |
| GitHub stars | 36 |
| Author | Charles Riley |
| Maintainers | criles25 |

## Links

- npm: https://www.npmjs.com/package/postgrest-auth
- Repository: https://github.com/criles25/postgrest-auth
- Issues: https://github.com/criles25/postgrest-auth/issues
- npm.io page: https://npm.io/package/postgrest-auth

## Dependencies (15)

- [pg](https://npm.io/package/pg.md) ^7.0.2
- [knex](https://npm.io/package/knex.md) ^0.13.0
- [debug](https://npm.io/package/debug.md) ^2.6.8
- [bcrypt](https://npm.io/package/bcrypt.md) ^1.0.2
- [lodash](https://npm.io/package/lodash.md) ^4.17.4
- [morgan](https://npm.io/package/morgan.md) ^1.8.2
- [express](https://npm.io/package/express.md) ^4.15.3
- [nodemon](https://npm.io/package/nodemon.md) ^1.11.0
- [minimist](https://npm.io/package/minimist.md) ^1.2.0
- [nodemailer](https://npm.io/package/nodemailer.md) ^4.0.1
- [body-parser](https://npm.io/package/body-parser.md) ^1.17.2
- [jsonwebtoken](https://npm.io/package/jsonwebtoken.md) ^7.4.1
- [http-status-codes](https://npm.io/package/http-status-codes.md) ^1.1.6
- [express-validation](https://npm.io/package/express-validation.md) ^1.0.2
- [express-bearer-token](https://npm.io/package/express-bearer-token.md) ^2.1.0

## Recent versions

- 0.0.3 (latest) — 2017-08-06
- 0.0.2 — 2017-08-05
- 0.0.1 — 2017-08-05

## README

# postgrest-auth

`postgrest-auth` is an authorization server for [PostgREST](https://github.com/begriffs/postgrest) written in [Node.js](https://github.com/nodejs/node).

It provides the following endpoints:

```
POST /auth/users # create a new user and responds with an "access_token"

POST /auth/refresh_token # returns a new access_token

POST /auth/change_password # changes a user's password and returns a new access_token

POST /auth/change_email # changes a user's email

POST /auth/forgot_password # emails a reset_token that can be used to change password

POST /auth/forgot_username # emails the user his or her username
```

#### Setup
Install `postgrest-auth`:

```
npm i -g postgrest-auth
```

`postgrest-auth` uses a `web_anon` role for unauthenticated users and a `normal_user` role for users that are authenticated.

You must specify the anonymous role in your `postgrest.conf` file.

```
db-anon-role = "web_anon"
```

To invalidate unexpired or stolen tokens, `postgrest-auth` uses the [token count strategy](https://stackoverflow.com/a/24235103).

Update your `postgrest.conf` to add the `auth.check_token_count()` function to the `pre-request` field.

```
pre-request = "auth.check_token_count"
```

Lastly, `postgrest-auth` uses a `postgrest-auth.json` file to know how to connect to postgres and the email account that will send emails when users signup, forget their passwords, forget their usernames, etc. You will have to change the `postgrest-auth.json` example below to work with your application configuration.

```
// postgrest-auth.json example
{
  "app_name": "A Game of Theories", // used in email signature
  "db": {
    "connection": {
      "host": "localhost",
      "port": 5432,
      "database": "postgres",
      "user": "postgres",
      "password": "pass"
    },
    "connection_string": "postgres://postgres:pass@localhost/postgres",
    "pool": {
      "min": 2,
      "max": 10
    },
    "schema": "auth",
    "table": "users"
  },
  "email": {
    "from": "contact@agameoftheories.com",
    "host": "mail.privateemail.com",
    "port": 465,
    "secure": true,
    "auth": {
        "user": "contact@agameoftheories.com",
        "pass": "thepassword"
    }
  },
  "payload": {
    "exp": 604800,
    "iss": "https://agameoftheories.com"
  },
  "port": 3001,
  "roles": {
    "anonymous": "web_anon",
    "user": "normal_user"
  },
  "secret": "secret" // jwt secret
}
```

Once you have created the `postgrest-auth.json` file, start the `postgrest-auth` server.

```
postgrest-auth --config postgrest-auth.json
```

---
_Source: https://npm.io/package/postgrest-auth · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._