Adding Authentication to API

.gitignore

@@ -1,2 +1,8 @@
 node_modules/
 build/
+env/
+
+config/*.yml
+!config/test.yml
+
+.DS_Store

.vscode/launch.json

@@ -12,6 +12,12 @@
       "runtimeArgs": ["--nolazy", "-r", "ts-node/register/transpile-only"],
 
       "args": ["src/index.ts"],
+      "env": {},
+
+      "resolveSourceMapLocations": [
+        "${workspaceFolder}/**",
+        "!**/node_modules/**"
+      ],
 
       "cwd": "${workspaceRoot}",
       "internalConsoleOptions": "openOnSessionStart",

@types/express/index.d.ts

@@ -1,10 +1,10 @@
-import User from '../../src/model/users.model'
-
+import { AccessToken, RefreshToken } from 'devu-shared-modules'
 declare global {
   namespace Express {
     interface Request {
-      user?: User
-      users?: User[]
+      // Auth Data
+      currentUser?: AccessToken // Deserialized access token
+      refreshUser?: RefreshToken // Deserialized refresh token
     }
   }
 }

README.md

@@ -37,6 +37,12 @@ Run the initial migrations to setup our DB schema
 npm run typeorm -- migration:run
 ```
 
+Run the setup script to create local development auth keys. These are used in local development for signing and authenticating JWTs.
+
+```
+npm run generate-config
+```
+
 Once you've got all the dependencies installed you can run the project via
 
 ```
@@ -82,7 +88,7 @@ For those unfamiliar with Express, I'll attempt to give a brief rundown before t
 Express is a REST framework for node. Devs new to express will likely find one of the most perplexing parts of Express to be how it handles middleware. For those unfamiliar with what middleware is, it's largely a catch all term for code that connects together pieces of code in the api. In Express's context, middleware is basically everything that runs within each router; here's an example:
 
 ```typescript
-Router.get('/:id', idAsInt, UserController.detail, serializer)
+Router.get('/:id', idAsInt, UserController.detail)
 ```
 
 In express, all of the functions added after the route's path are considered middleware and each route can have as many middleware as is needed. In this project we separate out `controllers` into their own directory though they are still considered middleware.
@@ -113,11 +119,11 @@ Let's take this from the top
 - `index.ts`: where the application is bootstrapped from, controls all global server controls and middlewares
 - `routers/index.ts`: largely a rollup for all the other routers. Can be used to add router specific middleware to routes/ subroutes
 - `routers/route.ts`: Individual routes for each resource, where the list of middleware can be found. _All routers call unique middleware_
-- Middleware: The above diagram is a bit of a misnomer. Not every endpoint will have validators, controllers, and serializers. Some will have all of those, some may have none. Each route will have at least one middleware, and the last middleware will deal with returning the requested data
+- Middleware: The above diagram is a bit of a misnomer. Not every endpoint will have auth, validators, and controllers. Some will have all of those, some may have none. Each route will have at least one middleware, and the last middleware will deal with returning the requested data
+- Auth: checks the access/ refresh tokens
 - Validators: validates the bodies of requests
-- Controllers: deals with setting status codes, and directing to services
+- Controllers: deals with setting status codes, and directing to services. For the most part, controllers should be the last piece of middleware in the chain.
 - Services: Workhorse of the application. Deals with all major application logic and database calls
-- Serializers: Formats the data to be a sane, reusable response.
 
 The database models live outside of this control flow as they don't deal with any buisness logic. However services will use them to access the database. You can largely think of the the models as a 1:1 map to database tables.
 

config/default.yml.template

@@ -0,0 +1,77 @@
+api:
+  clientUrl: http://localhost:9000
+  scheme: http
+  host: localhost
+  port: 3001
+
+database:
+  host: 'localhost'
+  username: 'typescript_user'
+  password: 'password'
+  database: 'typescript_api'
+
+logging:
+  db: false
+
+auth:
+  jwt:
+    activeKeyId: sk07112021
+    accessTokenValiditySeconds: 600 # 10 minutes (seconds)
+    refreshTokenValiditySeconds: 864000 # 10 days (seconds)
+    refreshTokenExpirationBufferSeconds: 86400 # 1 days (seconds))
+    keys:
+      sk07112021:
+        privateKey: |
+          -----BEGIN RSA PRIVATE KEY-----
+          ...
+          -----END RSA PRIVATE KEY-----
+        publicKey: |
+          -----BEGIN RSA PUBLIC KEY-----
+          ...
+          -----END RSA PUBLIC KEY-----
+
+  providers:
+    devAuth:
+      enabled: true
+
+    saml:
+      name: MyUB
+      enabled: false
+      entryPoint: https://samltest.id/idp/profile/SAML2/Redirect/SSO
+      attributeMap:
+        urn:oid:0.9.2342.19200300.100.1.3: email
+        urn:oid:0.9.2342.19200300.100.1.1: externalId
+        urn:oasis:names:tc:SAML:attribute:subject-id: identifier
+        urn:oid:2.5.4.4: sn
+        urn:oid:2.16.840.1.113730.3.1.241: displayName
+        urn:oid:2.5.4.20: telephoneNumber
+        urn:oid:2.5.4.42: givenName
+        https://samltest.id/attributes/role: role
+        urn:oid:1.3.6.1.4.1.5923.1.1.1.7: eduPersonEntitlement
+      idpCerts:
+        - |
+          -----BEGIN CERTIFICATE-----
+          ...
+          -----END CERTIFICATE-----
+        - |
+          -----BEGIN CERTIFICATE-----
+          ...
+          -----END CERTIFICATE-----
+      encryption:
+        privateKey: |
+          -----BEGIN PRIVATE KEY-----
+          ...
+          -----END PRIVATE KEY-----
+        certificate: |
+          -----BEGIN CERTIFICATE-----
+          ...
+          -----END CERTIFICATE-----
+      signing:
+        privateKey: |
+          -----BEGIN PRIVATE KEY-----
+          ...
+          -----END PRIVATE KEY-----
+        certificate: |
+          -----BEGIN CERTIFICATE-----
+          ...
+          -----END CERTIFICATE-----

config/test.yml

@@ -0,0 +1,77 @@
+api:
+  clientUrl: http://localhost:9000
+  scheme: http
+  host: localhost
+  port: 3001
+
+database:
+  host: 'localhost'
+  username: 'typescript_user'
+  password: 'password'
+  database: 'typescript_api'
+
+logging:
+  db: false
+
+auth:
+  jwt:
+    activeKeyId: sk07112021
+    accessTokenValiditySeconds: 600 # 10 minutes (seconds)
+    refreshTokenValiditySeconds: 864000 # 10 days (seconds)
+    refreshTokenExpirationBufferSeconds: 86400 # 1 days (seconds)
+    keys:
+      sk07112021:
+        privateKey: |
+          -----BEGIN RSA PRIVATE KEY-----
+          ...
+          -----END RSA PRIVATE KEY-----
+        publicKey: |
+          -----BEGIN RSA PUBLIC KEY-----
+          ...
+          -----END RSA PUBLIC KEY-----
+
+  providers:
+    devAuth:
+      enabled: true
+
+    saml:
+      name: MyUB
+      enabled: false
+      entryPoint: https://samltest.id/idp/profile/SAML2/Redirect/SSO
+      attributeMap:
+        urn:oid:0.9.2342.19200300.100.1.3: email
+        urn:oid:0.9.2342.19200300.100.1.1: externalId
+        urn:oasis:names:tc:SAML:attribute:subject-id: identifier
+        urn:oid:2.5.4.4: sn
+        urn:oid:2.16.840.1.113730.3.1.241: displayName
+        urn:oid:2.5.4.20: telephoneNumber
+        urn:oid:2.5.4.42: givenName
+        https://samltest.id/attributes/role: role
+        urn:oid:1.3.6.1.4.1.5923.1.1.1.7: eduPersonEntitlement
+      idpCerts:
+        - |
+          -----BEGIN CERTIFICATE-----
+          ...
+          -----END CERTIFICATE-----
+        - |
+          -----BEGIN CERTIFICATE-----
+          ...
+          -----END CERTIFICATE-----
+      encryption:
+        privateKey: |
+          -----BEGIN PRIVATE KEY-----
+          ...
+          -----END PRIVATE KEY-----
+        certificate: |
+          -----BEGIN CERTIFICATE-----
+          ...
+          -----END CERTIFICATE-----
+      signing:
+        privateKey: |
+          -----BEGIN PRIVATE KEY-----
+          ...
+          -----END PRIVATE KEY-----
+        certificate: |
+          -----BEGIN CERTIFICATE-----
+          ...
+          -----END CERTIFICATE-----