@voilab/vmol-auth

This package is part of the vmol collection.

Moleculer middlewares providing authentication and authorization features.

Features

• JWT based authentication
• Handle user (interactive), application (machine) and anonymous (public) authentication
• Casl based authorization
• Mutli roles and multi tenants support
• Highly configurable
• Fully tested

Install

npm install @voilab/vmol-auth --save

Authentication Middleware

Authentication Configuration

| Property | Type | Default | Description | |-|-|-|-| | userJWTParamsAction | String | 'authentication.getJWTParams' | The action name to call to get the user JWT params. | | appAuthGetPublicKeyAction | String | 'authentication.getApplicationPublicKey' | The action name to call to get the public key for application authentication. | | jwtClockTolerance | Number | 30 | The clock tolerance for JWT verification. | | jwtParamsTTL | String | '1h' | The time-to-live for the JWT parameters cache. | | applicationKeysCacheSize | Number | 128 | The maximum size of the application keys cache. | | applicationKeysCacheTTL | String | '1d' | The time-to-live for the application keys cache. | | applicationJwtClockTolerance | Number | 30 | The clock tolerance for application JWT verification. | | applicationJwtMaxAge | String | '30m' | The maximum age for application JWT verification. | | slugSeparator | String | ':' | The separator for the authentication slug. | | serviceBlacklist | Array.<String> | [] | The list of services to skip the authentication middleware. The $node service is always added to the blacklist. |

Authorization Middleware

Authorization Configuration

| Property | Type | Default | Description | |-|-|-|-| | abilitiesForRoleAction | String | 'authorization.getAbilitiesForRole' | The action name to call to get the abilities for a role. | | defaultAbilitiesAction | String | 'authorization.getDefaultAbilities' | The action name to call to get the default abilities. | | applicationRolesAction | String | 'authorization.getApplicationRoles' | The action name to call to get the roles for an application. | | applicationRolesActionParam | String | 'id' | The parameter name containing the application ID. | | applicationRolesActionSecret | String | null | The secret to send with the request. | | userRolesAction | String | 'authorization.getUserRoles' | The action name to call to get the roles for a user. | | userRolesActionParam | String | 'id' | The parameter name containing the user ID. | | userRolesActionSecret | String | null | The secret to send with the request. | | anonymousRolesAction | String | 'authorization.getAnonymousRoles' | The action name to call to get the anonymous roles. | | entitiesRolesCacheMax | Number | 128 | The maximum number of entities to cache roles for. | | entitiesRolesCacheTTL | String | '1h' | The time-to-live for the entities roles cache. | | roleAbilitiesCacheMax | Number | 128 | The maximum number of roles to cache abilities for. | | roleAbilitiesCacheTTL | String | '1h' | The time-to-live for the role abilities cache. | | compiledAbilitiesCacheMax | Number | 128 | The maximum number of role combinations to cache compiled abilities for. | | compiledAbilitiesCacheTTL | String | '1h' | The time-to-live for the compiled abilities cache. | | serviceBlacklist | Array.<String> | [] | The list of services to skip the authorization middleware. The $node service is always added to the blacklist. |

v0.6.0 Migration

Both mxins have been replaced by middlewares.

moleculer.config.js

Require the middlewares and add them to the middlewares array. Take care of the order, the authentication middleware must be called before the authorization middleware. Which means that the authentication middleware must be after the authorization middleware in the array. This because the middleware are called in the reverse order.

+const AuthorizationMiddleware = require('@voilab/vmol-auth').Authorization;
+const AuthenticationMiddleware = require('@voilab/vmol-auth').Authentication;

module.exports = {
    // Register custom middlewares
    middlewares: [
+        AuthorizationMiddleware({
+            userRolesAction: 'myservice.getRolesForUser',
+            userRolesActionSecret: process.env.MY_ACTION_SECRET
+        }),
+        AuthenticationMiddleware({
+            userJWTParamsAction: 'myservice.getJWTParamsPublic'
+        })
    ]
}

Services

The old mixins must be removed from the services.

-const { AuthorizationMixin, AuthenticationMixin } = require('@voilab/vmol-auth');
-
module.exports = {
    name: 'myservice',

-    mixins: [AuthorizationMixin, AuthenticationMixin],
-
    settings: {
        foo: 'bar',
-        auth: {
-            tokenService: 'authservice',
-            abilityService: 'authservice'
-        }
    },

    /**
     * Actions
     */
    actions: {}
};

Public actions

Actions that does not require authentication and/or authorization need the disableAuthentication and/or disableAuthorization options.

module.exports = {
    name: 'myservice',

    settings: {
        foo: 'bar'
    },

    actions: {
        publicAction: {
            disableAuthentication: true,
            disableAuthorization: true,

            handler(ctx) {
                return 'Hello world!';
            }
        }
    }
};

Tests

npm run test

License

This project is under MIT License.

Author

This package has been created by Voilab.

Copyright

Copyright (c) 2013-2024, Voilab SNC