CS9: Auth II

const express = require('express')
const db = require('./_config/db')
const setupMiddleware = require('./config/middleware')
const setupRoutes = require('./config/routes');

const server = express()

db
    .connectTo('jwtauth')
    .then(() => console.log('\n... API Connected to jwtauth Database ...\n'))
    .catch(err => {
        console.log('\n ERROR Connecting to MongoDB, is it running? \n', err)
    })

setupMiddleware(server)
setupRoutes(server)

server.listen(5500, () => console.log('\n=== API running on port 5500 ===\n' ))

const userRoutes = require ('.../users/userRoutes');
const authRoutes = require('.../auth/authRoutes');

module.exports = function(server) {
    server.get('/', function(req, res) {
        res.send({ api: 'up and running' })
});

server.use('/api/users', userRoutes);
server.use('/api/auth', authRoutes);
};

const router = require('express').Router()
const User = require('./User');

router.get('/', (req, res) => {
    User.find()
    .select('-password') // remove password from data sent on response
    .then(users => {
        res.json(users);
    })
    .catch(err => {
        res.status(500).json(err);
    })
})

module.exports = router

const router = require('express').Router()
const User = require('.../users/User');

router.post('/register', function(req, res) {
User.create(req.body) // this does new User and user.save
    .then(user => {
        res.status(201).json(user);
        // will remove password later - need to make sure it's hashed, that's why it's there
    })
    .catch(err => res.status(500).json(err))
})

module.exports = router;


const mongoose = require('mongoose)
const bcrypt = require('bcrypt')

const userSchema = new mongoose.Schema({
    username: {
        type: String,
        required: true,
        unique: true,
        lowercase: true,
    },
    password: {
        type: String,
        required: true,
        minLength: 4, // make this at least 12 in production
    }
})

userSchema.pre('save', function(next) {
    return bcrypt.hash(this.password, 10)
    .then(hash => {
        this.password = hash;
    return next();
    })
    .catch(err => {
        return next(err)
    })
})

userSchema.methods.validatePassword = function(passwordGuess {
    return bcrypt.compare(passwordGuess, this.password)
})

const router = require('express').Router()
const jwt = require('jsonwebtoken')
const User = require('.../users/User');

const secret = 'that is what I shared yesterday lol'; // would probably come from config file
// on every request, client sends token - secret is how you decrypt and encrypt token to make sure it's the right one
router.post('/register', function(req, res) {
    User.create(req.body) // this does new User and user.save
        .then(user => {
            const token = makeToken(user);
            res.status(201).json({ user, token }); // will remove password later - need to make sure it's hashed, that's why it's there
        })
        .catch(err => res.status(500).json(err))
})

function makeToken(user) {  // Would probably put this in a different file for helperfunctions
    // build the token
const timestamp = new Date().getTime()
    const payload = {
        sub: user._id,
        iat: timestamp,
        username: user.username
    };
const options = { // list of options found at https://www.npmjs.com/package/jsonwebtoken
        expiresIn: '24h' // Every day, user needs to refresh token
    };
    return jwt.sign(payload, secret, options); // synchronous operation
}

module.exports = router;

const router = require('express').Router()

const jwt = require('jsonwebtoken')
const passport = require('passport');
const LocalStrategy = require('passport-local')

const { JwtStrategy } = require('passport-jwt').Strategy;
const ExtractJwt = require('passport-jwt')

const User = require('.../users/User');

const secret = 'that is what I shared yesterday lol'; // would probably come from config file
// on every request, client sends token - secret is how you decrypt and encrypt token to make sure it's the right one

const localStrategy = new LocalStrategy(function(username, password, done) { // done is kind of like next() and acts like a callback
    User.findOne({username}).then(user => {
        if (!user) { // user could return the user or null, thus the if statement
            done(null, false)
        } else {
            user.validatePassword(password) // password is coming from strategy library
                .then(isValid => {
                    if (isValid) {
                        const { _id, username } = user
                        return done(null, { _id, username }) // this ends in req.user
                    } else {
                        return done(null, false)
                    }
                }).catch(err => {
                    return done(err);
                })
            }
    }).catch(err => done(err))
})

const jwtOptions = {
    jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
    secretOrKey: secret
}

const jwtStrategy = new JwtStrategy(jwtOptions, function(payload, done) {
    User.findById(payload.sub) // when we made the token, inside the payload of the token we say that the userId is the sub
        .then(user => {
            if(user) {
                done(null, user) // this is req.user
            } else {
                done(null, false)
            }
        }).catch(err => {
            done(err)
        })
}

// passport global middleware
passport.use(localStrategy);
passport.use(jwtStrategy);

// passport local middleware
const passportOptions = { session: false } // by default passport will use sessions
const authenticate = passport.authenticate('local', pssportOptions)
// we set this to false because we want to use JSON web tokens
const protected = passport.authenticate('jwt', passportOptions)

// helpers
function makeToken(user) {  // Would probably put this in a different file for helperfunctions
// build the token
    const timestamp = new Date().getTime()
    const payload = {
        sub: user._id,
        iat: timestamp,
        username: user.username
    };
    const options = { // list of options found at https://www.npmjs.com/package/jsonwebtoken
        expiresIn: '24h' // Every day, user needs to refresh token
    };
    return jwt.sign(payload, secret, options); // synchronous operation
}

// routes

module.exports = function(server) {
server.get('/', function(req, res) {
    res.send({ api: 'up and running' })
})

server.post('/register', function(req, res) {
    User.create(req.body) // this does new User and user.save
        .then(user => {
            const token = makeToken(user);
            res.status(201).json({ user, token }); // will remove password later - need to make sure it's hashed, that's why it's there
        })
        .catch(err => res.status(500).json(err))
})

server.post('/login', authenticate, (req, res) => {
    // if we're here the user logged in correctly
    res.status(200).json({ token: makeToken(req.user), user: req.user })
});

server.get('/users', (req, res) => {
    User.find()
        .select('username')
        .then(users => {
            res.json(users);
        }).catch(err => {
            res.status(500).json(err)
        })
    })
}