change to use session for auth

+ replace BearerAuth to cookieAuth in swagger
+ add swagger.yaml to nodemon watch list

server/src/api/controllers/authController.js

@@ -92,8 +92,15 @@ export async function register(req, res, next) {
     user.hashedPassword = await hashPassword(password)
     await user.save()
     req.user = user
-    res.status(201)
-    next()
+    req.login(user, (err) => {
+      if (err) {
+        next(err)
+        return
+      }
+      res.status(201).json({
+        message: 'user created',
+      })
+    })
   } catch (err) {
     console.error(err)
     res.status(500).json({
@@ -101,3 +108,16 @@ export async function register(req, res, next) {
     })
   }
 }
+
+export function logout(req, res) {
+  req.logout((err) => {
+    if (err) {
+      console.error(err)
+      res.status(500).json({
+        message: 'error logging out',
+      })
+      return
+    }
+    res.json({ message: 'success' })
+  })
+}

server/src/api/routes/auth.js

@@ -2,20 +2,24 @@ import { Router } from 'express'
 import passport from 'passport'
 
 import {
-  issueToken,
   register,
   checkUsername,
+  logout,
 } from '../controllers/authController.js'
 
 const router = Router()
 
 router.post(
   '/login',
-  passport.authenticate('local', { session: false, failWithError: true }),
-  issueToken
+  passport.authenticate('local', { failureMessage: true }),
+  (req, res) => {
+    res.json({ message: 'success' })
+  }
 )
 
-router.post('/register', register, issueToken)
+router.post('/register', register)
+
+router.post('/logout', logout)
 
 router.get('/check', checkUsername)
 

server/src/api/routes/index.js

@@ -6,6 +6,7 @@ import commands from './commands.js'
 import authRouter from './auth.js'
 
 const router = Router()
+router.use(passport.authenticate('session'))
 
 router.get('/', (req, res) => {
   res.send('Hello API!')
@@ -13,15 +14,11 @@ router.get('/', (req, res) => {
 
 router.use('/auth', authRouter)
 router.use('/quests', quests)
-router.use(
-  '/sessions',
-  passport.authenticate('jwt', { session: false, failWithError: true }),
-  sessions
-)
-router.use(
-  '/commands',
-  passport.authenticate('jwt', { session: false, failWithError: true }),
-  commands
-)
+
+const authZone = Router()
+authZone.use('/sessions', sessions)
+authZone.use('/commands', commands)
+
+router.use(authZone)
 
 export default router

server/src/auth/jwtStrategy.js

@@ -1,13 +0,0 @@
-import { Strategy as JwtStrategy, ExtractJwt } from 'passport-jwt'
-import config from '../config.js'
-
-const jwtOptions = {
-  jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
-  secretOrKey: config.jwtSecret,
-}
-
-function verifyJwt(jwtPayload, done) {
-  return done(null, jwtPayload)
-}
-
-export default new JwtStrategy(jwtOptions, verifyJwt)

server/src/auth/passport.js

@@ -1,6 +1,20 @@
 import passport from 'passport'
 import PasswordStrategy from './passwordStrategy.js'
-import JwtStrategy from './jwtStrategy.js'
 
 passport.use(PasswordStrategy)
-passport.use(JwtStrategy)
+
+passport.serializeUser((user, done) => {
+  process.nextTick(() => {
+    done(null, {
+      _id: user._id,
+      username: user.username,
+      email: user.email,
+    })
+  })
+})
+
+passport.deserializeUser((user, done) => {
+  process.nextTick(() => {
+    done(null, user)
+  })
+})

server/src/db.js

@@ -3,10 +3,15 @@ import config from './config.js'
 
 export default async function connectDB() {
   try {
-    await mongoose.connect(config.db)
+    const db = await mongoose.connect(config.db, {
+      useNewUrlParser: true,
+      useUnifiedTopology: true,
+    })
     console.log('Connected to MongoDB')
+    return db.connection.getClient()
   } catch (err) {
     console.error(err)
     process.exit(1)
+    return null
   }
 }

server/src/index.js

@@ -11,14 +11,12 @@ import apiRouter from './api/routes/index.js'
 import loadAndUpdateQuests from './utils/quest.js'
 import config from './config.js'
 import errorHandler from './middleware/error.js'
+import sessionMiddleware from './middleware/session.js'
 import expiryRemovalScheduler from './containers/expiryChecker.js'
 import { createTestUser } from './utils/auth.js'
 
 async function main() {
-  const app = express()
-  const server = http.createServer(app)
-  socketServer(server)
-  await connectDB()
+  const db = await connectDB()
 
   await createTestUser()
 
@@ -27,8 +25,19 @@ async function main() {
 
   const file = await fs.readFile('./swagger.yaml', 'utf8')
   const swaggerDocument = YAML.parse(file)
+
+  const app = express()
+  const server = http.createServer(app)
+  socketServer(server)
   app.use(errorHandler)
-  app.use('/api-docs', swaggerUI.serve, swaggerUI.setup(swaggerDocument))
+  app.use(sessionMiddleware(db))
+  app.use(
+    '/api-docs',
+    swaggerUI.serve,
+    swaggerUI.setup(swaggerDocument, {
+      withCredentials: true,
+    })
+  )
   app.use(express.json())
 
   app.get('/', (req, res) => {

server/src/middleware/session.js

@@ -0,0 +1,20 @@
+import session from 'express-session'
+import MongoStore from 'connect-mongo'
+
+import config from '../config.js'
+
+export default (db) => {
+  console.log(db.constructor.name)
+  return session({
+    secret: config.jwtSecret,
+    resave: false,
+    saveUninitialized: false,
+    cookie: {
+      httpOnly: true,
+    },
+    store: MongoStore.create({
+      mongoUrl: config.db,
+      collectionName: 'loginSessions',
+    }),
+  })
+}