added authentication and permissions

Author: mohanmakonis

.gitignore

@@ -1,3 +1,4 @@
+.vscode
 # Logs
 logs
 *.log

README.md

@@ -1,4 +1,10 @@
 # api
 
+git clone
+npm install
+update db details in src/datasources/mysql.datasource.config.json
+npm run build
+num run migrate
+
 [![LoopBack](https://github.com/strongloop/loopback-next/raw/master/docs/site/imgs/branding/Powered-by-LoopBack-Badge-(blue)-@2x.png)](http://loopback.io/)
 # loopback4-authentication-jwt-roles

package-lock.json

@@ -58,6 +58,7 @@
     "@types/bcryptjs": "^2.4.2",
     "bcryptjs": "^2.4.3",
     "isemail": "^3.2.0",
+    "jsonwebtoken": "^8.5.1",
     "loopback-connector-mysql": "^5.4.2"
   },
   "devDependencies": {

package.json

@@ -1,21 +1,33 @@
-import {BootMixin} from '@loopback/boot';
-import {ApplicationConfig} from '@loopback/core';
+import { BootMixin } from '@loopback/boot';
+import { ApplicationConfig } from '@loopback/core';
 import {
   RestExplorerBindings,
   RestExplorerComponent,
 } from '@loopback/rest-explorer';
-import {RepositoryMixin} from '@loopback/repository';
-import {RestApplication} from '@loopback/rest';
-import {ServiceMixin} from '@loopback/service-proxy';
+import { RepositoryMixin } from '@loopback/repository';
+import { RestApplication } from '@loopback/rest';
+import { ServiceMixin } from '@loopback/service-proxy';
 import path from 'path';
-import {MySequence} from './sequence';
+import { MySequence } from './sequence';
+import { BcryptHasher } from './services/hash.password.bcrypt';
+import { MyUserService } from './services/user.service';
+import { JWTService } from './services/jwt-service';
+import { TokenServiceConstants, TokenServiceBindings, UserServiceBindings, PasswordHasherBindings } from './keys';
+import { AuthenticationComponent, registerAuthenticationStrategy } from "@loopback/authentication";
+import { JWTStrategy } from "./authentication-stategies/jwt-strategy"
 
 export class ApiApplication extends BootMixin(
   ServiceMixin(RepositoryMixin(RestApplication)),
 ) {
   constructor(options: ApplicationConfig = {}) {
     super(options);
 
+    // set up bindings
+    this.setupBinding();
+
+    this.component(AuthenticationComponent);
+    registerAuthenticationStrategy(this, JWTStrategy);
+
     // Set up the custom sequence
     this.sequence(MySequence);
 
@@ -39,4 +51,18 @@ export class ApiApplication extends BootMixin(
       },
     };
   }
+
+  setupBinding(): void {
+    this.bind(PasswordHasherBindings.PASSWORD_HASHER).toClass(BcryptHasher);
+    this.bind(PasswordHasherBindings.ROUNDS).to(10);
+    this.bind(UserServiceBindings.USER_SERVICE).toClass(MyUserService);
+    this.bind(TokenServiceBindings.TOKEN_SERVICE).toClass(JWTService);
+    this.bind(TokenServiceBindings.TOKEN_SECRET).to(
+      TokenServiceConstants.TOKEN_SECRET_VALUE,
+    );
+    this.bind(TokenServiceBindings.TOKEN_EXPIRES_IN).to(
+      TokenServiceConstants.TOKEN_EXPIRES_IN_VALUE,
+    );
+
+  }
 }

src/application.ts

@@ -0,0 +1,42 @@
+import {AuthenticationStrategy} from '@loopback/authentication';
+import {Request, HttpErrors} from '@loopback/rest';
+import {UserProfile} from '@loopback/security';
+import {inject} from '@loopback/core';
+import {TokenServiceBindings} from '../keys';
+import {JWTService} from '../services/jwt-service';
+
+export class JWTStrategy implements AuthenticationStrategy {
+  constructor(
+    @inject(TokenServiceBindings.TOKEN_SERVICE)
+    public jwtService: JWTService,
+  ) {}
+  name: string = 'jwt';
+  async authenticate(request: Request): Promise<UserProfile | undefined> {
+    const token: string = this.extractCredentials(request);
+    const userProfile = await this.jwtService.verifyToken(token);
+    return Promise.resolve(userProfile);
+  }
+  extractCredentials(request: Request): string {
+    if (!request.headers.authorization) {
+      throw new HttpErrors.Unauthorized('Authorization header is missing');
+    }
+
+    const authHeaderValue = request.headers.authorization;
+
+    // authorization  : Bearer xxxc..yyy..zzz
+
+    if (!authHeaderValue.startsWith('Bearer')) {
+      throw new HttpErrors.Unauthorized(`
+      Authorization header is not type of 'Bearer'.
+      `);
+    }
+    const parts = authHeaderValue.split(' ');
+    if (parts.length !== 2) {
+      throw new HttpErrors.Unauthorized(`
+     Authorization header has too many parts it must follow this pattern 'Bearer xx.yy.zz' where xx.yy.zz should be valid token
+    `);
+    }
+    const token = parts[1];
+    return token;
+  }
+}

src/authentication-stategies/jwt-strategy.ts

@@ -0,0 +1,10 @@
+export const enum PermissionKeys {
+    // Admin permissions
+    BlogManagement = 'BlogManagement',
+    UserManagement = 'UserManagement',
+
+    // User permissions
+    GetBlogs = 'GetBlogs',
+    AuthFeatures = 'AuthFeatures',
+    UserBasic = 'UserBasic'
+}

src/authorization/permission-keys.ts

@@ -0,0 +1,58 @@
+import { post, requestBody, getJsonSchemaRef, getModelSchemaRef } from "@loopback/rest";
+import { User } from "../models";
+import { validateCredentials } from "../services/validator";
+import { PasswordHasherBindings, UserServiceBindings } from "../keys";
+import { BcryptHasher } from "../services/hash.password.bcrypt";
+import { inject } from "@loopback/core";
+import { repository } from "@loopback/repository";
+import { UserRepository } from "../repositories";
+import * as _ from 'lodash';
+import { PermissionKeys } from "../authorization/permission-keys";
+
+// Uncomment these imports to begin using these cool features!
+
+// import {inject} from '@loopback/context';
+
+
+export class AdminController {
+  constructor(
+    @inject(PasswordHasherBindings.PASSWORD_HASHER)
+    public hasher: BcryptHasher,
+    @repository(UserRepository)
+    public userRepository: UserRepository,
+  ) { }
+
+  @post('/admin', {
+    responses: {
+      '200': {
+        description: 'Admin',
+        content: {
+          schema: getJsonSchemaRef(User),
+        },
+      },
+    },
+  })
+  async create(@requestBody({
+    content: {
+      'application/json': {
+        schema: getModelSchemaRef(User, {
+          title: 'NewUser',
+          exclude: ['id', 'permissions', 'additionalProp1'],
+        }),
+      },
+    },
+  })
+  admin: User) {
+    validateCredentials(_.pick(admin, ['email', 'password']));
+    admin.permissions = [
+      PermissionKeys.BlogManagement,
+      PermissionKeys.UserManagement
+    ]
+    admin.password = await this.hasher.hashPassword(admin.password);
+    const newAdmin = await this.userRepository.create(admin);
+    delete newAdmin.password;
+
+    return newAdmin;
+  }
+
+}