RoyDumblauskas/blog-service
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

complete login endpoint

Browse Source
This commit is contained in:
RoyDumblauskas
2026-06-29 00:27:51 -05:00
parent 5cbaef08d0
commit 29f0d38787
6 changed files with 168 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/db/schema.ts
+2 -2
View File
@@ -74,9 +74,9 @@ export const images = pgTable("images", {
export const users = pgTable("users", {
id: uuid().notNull().primaryKey().defaultRandom(),
display_name: varchar({ length: 63 }).notNull(),
display_name: varchar({ length: 63 }).unique().notNull(),
username: varchar({ length: 63 }).notNull(),
username: varchar({ length: 63 }).unique().notNull(),
hashed_password: varchar({ length: 255 }).notNull(),
logged_in: boolean().notNull().default(false),
backend/src/helpers/auth.ts
+75
View File
@@ -0,0 +1,75 @@
import crypto from 'crypto';
import JsonWebToken from '../types/JsonWebToken.ts';
export function verifySignature(header: string, payload: string, signature: string) {
const signingSecret = process.env.JWT_SECRET!;
const encodedMessage = header + "." + payload;
const calculatedSignature = crypto
.createHmac('sha256', signingSecret)
.update(encodedMessage)
.digest("base64url");
const csBuff = Buffer.from(calculatedSignature);
const sBuff = Buffer.from(signature);
return csBuff.length === sBuff.length &&
crypto.timingSafeEqual(csBuff, sBuff);
}
function base64UrlEncode(input: string) {
return Buffer.from(input).toString("base64url");
}
export function base64UrlDecode(str: string) {
return Buffer.from(str, "base64url").toString();
};
export function encodeMessage(header: JsonWebToken["header"], payload: JsonWebToken["payload"]): string {
const encodedHeader = base64UrlEncode(JSON.stringify(header));
const encodedPayload = base64UrlEncode(JSON.stringify(payload));
return `${encodedHeader}.${encodedPayload}`;
}
export function decodeJWT(token: string) {
const parts = token.split('.');
const header = JSON.parse(base64UrlDecode(parts[0]));
const payload = JSON.parse(base64UrlDecode(parts[1]));
const signature = parts[2]; // Signature remains encoded
return { header, payload, signature };
}
export function generateSignedJWT(userId: string, permissions: number): string {
const signingSecret = process.env.JWT_SECRET!;
const now = Math.floor(Date.now() / 1000);
// fifteen minutes
const expires = now + (15 * 60);
const header: JsonWebToken["header"] = {
alg: "HS256",
typ: "JWT",
};
const payload: JsonWebToken["payload"] = {
iat: now,
uid: userId,
prm: permissions,
exp: expires
};
const encodedMessage = encodeMessage(header, payload);
const signature = crypto
.createHmac('sha256', signingSecret)
.update(encodedMessage)
.digest("base64url");
return `${encodedMessage}.${signature}`;
}
backend/src/middleware/auth.ts
+7 -66
View File
@@ -1,25 +1,24 @@
import { Request, Response, NextFunction } from "express";
import crypto from 'crypto';
import JsonWebToken from '../types/JsonWebToken.ts';
import JsonWebToken, { defaultJWT } from '../types/JsonWebToken.ts';
import { verifySignature, decodeJWT } from '../helpers/auth.ts';
export async function auth(
export function auth(
req: Request,
res: Response,
next: NextFunction
) {
// read jwt
const authHeader = req.header("Authorization");
// If there is no jwt, proceed to request with default permissions
if (!authHeader) {
req.jwt = defaultJWT;
req.jwt = defaultJWT();
} else {
// otherwise decode the jwt
const [scheme, token] = authHeader.split(" ");
if (scheme.toLowerCase() != "bearer") {
return res.status(401).json({
error: "Invalid auth scheme (not Bearer)"
error: "Invalid JWT"
});
};
@@ -42,11 +41,12 @@ export async function auth(
}
const validClaims: boolean =
decodedToken.payload.exp < Math.floor(Date.now() / 1000) &&
decodedToken.payload.exp >= Math.floor(Date.now() / 1000) &&
decodedToken.header.alg === "HS256" &&
decodedToken.header.typ === "JWT";
if (validJWT && validClaims) {
console.log(decodedToken)
req.jwt = decodedToken;
} else {
// maybe attempt token refresh here
@@ -59,62 +59,3 @@ export async function auth(
next();
};
function verifySignature(header: string, payload: string, signature: string) {
const signingSecret = process.env.JWT_SECRET!;
const encodedMessage = header + "." + payload;
const calculatedSignature = crypto
.createHmac('sha256', signingSecret)
.update(encodedMessage)
.digest("base64url");
const csBuff = Buffer.from(calculatedSignature);
const sBuff = Buffer.from(signature);
return csBuff.length === sBuff.length &&
crypto.timingSafeEqual(csBuff, sBuff);
}
function base64UrlEncode(input: string) {
return Buffer.from(input).toString("base64url");
}
function encodeMessage(header: JsonWebToken["header"], payload: JsonWebToken["payload"]) {
const encodedHeader = base64UrlEncode(JSON.stringify(header));
const encodedPayload = base64UrlEncode(JSON.stringify(payload));
return encodedHeader + "." + encodedPayload;
}
function decodeJWT(token: string) {
const parts = token.split('.');
const decodeBase64Url = (str: string) => {
return Buffer.from(str, "base64url").toString();
};
const header = JSON.parse(decodeBase64Url(parts[0]));
const payload = JSON.parse(decodeBase64Url(parts[1]));
const signature = parts[2]; // Signature remains encoded
return { header, payload, signature };
}
// default fallback JWT
// works fine for all calls that only need "guest" auth
// individual routes will fail if prm (permissions)
// are insufficient
const defaultJWT: JsonWebToken =
{
header: {
alg: "none",
typ: "JWT",
},
payload: {
iat: -1,
uid: "",
prm: 44,
exp: -1,
},
signature: ""
};
backend/src/routes/auth.ts
+55 -1
View File
@@ -1,7 +1,61 @@
import { drizzle } from 'drizzle-orm/node-postgres';
import crypto from 'crypto';
import { eq } from 'drizzle-orm';
import { articles } from '../db/schema.ts';
import { users } from '../db/schema.ts';
import express, { Request, Response } from "express";
import { generateSignedJWT, base64UrlDecode } from '../helpers/auth.ts';
const db = drizzle(process.env.DATABASE_URL!);
const hashSecret = process.env.PASSWORD_HASH_SECRET!;
const presalt = process.env.PRESALT!;
const postsalt = process.env.POSTSALT!;
export const authRouter = express.Router();
// username and password => signed jwt
authRouter.get("/login", async (req: Request, res: Response) => {
const authHeader = req.header("Authorization");
if (!authHeader) return res.status(401)
.json({ error: "401: Missing Authorization Header" });
const [scheme, value] = authHeader.split(" ");
if (scheme.toLowerCase() != "basic") return res.status(401)
.json({ error: "401: Incorrect Authorization Scheme" });
const decodedHeader = base64UrlDecode(value);
const [username, password] = decodedHeader.split(":");
const hashedPassword = crypto
.createHmac('sha256', hashSecret)
.update(`${presalt}${password}${postsalt}`)
.digest("base64url");
const user = await db
.select()
.from(users)
.where(eq(users.username, username))
.limit(1);
const calculatedBuff = Buffer.from(hashedPassword);
const storedBuff = Buffer.from(user[0].hashed_password);
const match = calculatedBuff.length === storedBuff.length &&
crypto.timingSafeEqual(calculatedBuff, storedBuff);
if (!match)
return res.status(401).json({ error: "401: failed to authenticate username/password" });
const jwt = generateSignedJWT(user[0].id, user[0].permissions)
res.json({ signed_jwt: jwt });
});
authRouter.get("/logout", async (req: Request, res: Response) => {
});
authRouter.get("/signup", async (req: Request, res: Response) => {
});
backend/src/routes/users.ts
+5 -3
View File
@@ -8,10 +8,12 @@ const db = drizzle(process.env.DATABASE_URL!);
export const usersRouter = express.Router();
usersRouter.get("/getUsers", auth, async (req: Request, res: Response) => {
if (req.jwt.payload.prm === 44)
if (req.jwt.payload.prm != 77)
return res
.status(401)
.json({ error: "Cannot access endpoint with default permissions" });
.status(403)
.json({
error: "403: Forbidden"
});
const resp = await db.select().from(users);
res.json(resp)
backend/src/types/JsonWebToken.ts
+24
View File
@@ -1,3 +1,5 @@
import { encodeMessage } from '../helpers/auth.ts';
type JsonWebToken = {
header: {
alg: string;
@@ -14,4 +16,26 @@ type JsonWebToken = {
signature: string
};
// default fallback JWT
// works fine for all calls that only need "guest" auth
// individual routes will fail if prm (permissions)
// are insufficient
export function defaultJWT() {
return {
header: {
alg: "none",
typ: "JWT",
},
payload: {
iat: -1,
uid: "",
prm: 44,
exp: -1
},
signature: ""
}
}
export default JsonWebToken;