npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

fourspace-auth-service-ts

v2.0.0

Published

Typescript Server Side Authentication

Downloads

7

Readme

fourspace-auth-service-ts

Server side authentication services for web APIs

Features

  • Secure authentication using state of the art hashing
  • Token strategy for API user authentication
  • Authentication lifecycle management (user registration, password reset, token expiry)
  • Generic services to accomodate application specific user info
  • Flexible service interfaces for bespoke behaviour
  • Simple to plug in to express server middleware

Usage

Default implementation requires supply of two Data Access Object (DAO) implementations, and a messaging service implementation.

  • PrincipalDao to look up users (e.g. from DB or other source)
  • TokenDao to look up/store authentication tokens
  • PrincipalMessageService to send links for registration and password reset.

For demo purposes, basic in memory DAO implementations are included, as well as a message service which just writes to the console.

Use the service builder class to create the authentication service. For the default service, simply supply the required implementations.

AuthenticationServiceBuilder

import { AuthenticationServiceBuilder, PrincipalDaoDemo, createPasswordClaim } from 'fourspace-auth-service-ts';

// create a test user
const username = '[email protected]';
const password = 'testpassword';
const passwordHash = '$argon2id$v=19$m=65536,t=2,p=1$63rP0KVWybD9jDS5vCqlLA$2v8XhYF9m/y0yPMIese5IS7FxDBwT1XwjHJ0xzg8thE';
const principal = { username, passwordHash };

// create the default service
const service = new AuthenticationServiceBuilder()
    .setPrincipalDao(new PrincipalDaoDemo([principal]))
    .buildAuthenticationManager();

// use the service to authenticate a username/password
const passwordClaim = createPasswordClaim(username, password);
const context = await service.verifyPasswordClaim(passwordClaim);
if (context.isAuthenticated) {
  console.log('Authenticated with principal:', context.principal);
} else {
  console.log('Failed to authenticate:', context.errorMessage);
}

API

AuthenticationService<P> P is a generic for the user Principal type returned by the supplied DAO services

  verifyPasswordClaim(claim: AuthPasswordClaim): Promise<UserSecurityContext<P>>;
  • Verify a username/password pair for login. Returns the security context for that user
  requestResetPassword(resetRequest: ResetRequest): UserSecurityContext<P>;
  • Request a password reset. This will generate a reset token for the user and send a reset message via the message service.
  resetPassword(claim: AuthPasswordResetClaim): UserSecurityContext<P>;
  • Reset the password for a user. The claim must contain a valid reset token
  verifyTokenClaim(claim: AuthTokenClaim): Promise<UserSecurityContext<P>>;
  createUserToken(context: UserSecurityContext<P>): Promise<string>;

Workflow

  • Register user (user name and password) - create user and verify token

  • Message user with verify link - user is verfied and log in can take place

  • Log in - access token and refresh token (and remember me if requested) created

  • API calls made using access token

  • Refresh access - when access token is close to expiry/expired, only the refresh token can create new access token

    1. verify refresh token
    2. create new access token and new refresh token

2 scenarios: log in user name/password - receive access and refresh access expired - supply refresh token to get new access/refresh pair (refresh token has updated)

Access token - valid for ATE mins refresh token - valid for RTE hours

continuous website use - constant usage of access token every ATE mins a new access token is produced and refresh token hash and expiry is updated when usage stops without logout, refresh token stays valid for between RTE-ATE and RTE mins once RT is expired, new log in is required (unless a remember me token exists)

When AT is refreshed, new AT is created (old AT may remain active or be deleted, not sure yet) and modified RT is returned AT -> RT link required if we want AT to be verified with RT and if we want AT to be deleted reset token key can be associated to many access tokens if we don't delete active token

Tokens

There are multiple tokens used to authenticate certain activities

  • Verify Token - verifies the user (email registration workflow)
  • Access Token - allows access to the API (short lived)
  • Refresh Token - allows creation of a new access token (invalidating associated token if not already expired)
  • Reset Token - allows a user to reset a forgotten password (email reset workflow)
  • Remember Token - token for remaining signed in despite inactivity (no expiry)

Service Implementations

TokenDao Verify user - only one token per user at any time

  1. create verification token (deletes all other verify tokens for this user)
  2. send to user
  3. user clicks link
  4. token authenticated and then deleted (can only verify once with this token)
  5. user updated

if at 4) authenticated and another API call creates verification token, then current token is already deleted

Reset password

  1. create reset token (deletes all other reset tokens for this user)
  2. send to user
  3. user follows link
  4. token authenticated and deleted (can only be attempted once with this token)
  5. password reset

if (before 4) another API calls create reset token, then token is no longer valid if at (4) authenticated and another API call creates reset token, then current token is already deleted

Install

npm install fourspace-auth-service-ts

Credits

License

MIT