Strategy

Here is an example of a strategy extending the Strategy class in order to configure it and use it in passport.

@Injectable()  
export default class JwtStrategy extends Strategy {  
   constructor(private readonly authenticationService: AuthenticationService) {  
       super({  
            jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),  
            passReqToCallback: true,  
            secretOrKey: 'secret'  
        }, async (req, payload, next) => {  
            return await this.verify(req, payload, next);  
        });  
        passport.use(this);  
    }  

   public async verify(req, payload, done) {  
       const isValid = await this.authenticationService.validateUser(payload);  
        if (!isValid) {  
           return done('Unauthorized', null);  
        } else {  
           return done(null, payload);  
        }  
   }  
}

The constructor allows you to pass some configuration parameters to the extended Strategy class. In this case we are using only three parameters:

• jwtFromRequest option accepts a function in order to extract the token from the request. In our case we are using the ExtractJwt.fromAuthHeaderAsBearerToken() function provided by the passport-jwt package. This function will pick the token from the header of the request using the Authorization header, and pick the token that follows the bearer word.
• passReqToCallback parameter takes a boolean in order to tell if you want to get the req in the verify method that you will see later.
• secretOrKey parameter takes a string or a buffer in order to verify the token signature.

Other parameters are available to configure the strategy, but to implement our authentication we don’t need them.

Also, after passing the different previous parameters, we pass a callback function called verify. This function is asynchronous, and has the purpose to verify if the token passed and if the payload obtained from the token is valid or not. This function executes our verify method, which calls the authenticationService in order to validate the user with the payload as a parameter.

If the user is valid, we return the payload, otherwise we return an error to indicate that the payload is not valid.

Authentication service

As shown in the previous section, in order to verify the payload that you get from the token, call the validateUser method provided by the AuthenticationService.

In fact, this service will implement another method in order to generate the token for the logged in user. The service can be implemented as the following example.

@Injectable()  
export class AuthenticationService {  
   constructor(private readonly userService: UserService) { }  

   createToken(email: string, ttl?: number) {  
        const expiresIn = ttl || 60 * 60;  
        const secretOrKey = 'secret';  
        const user = { email };  
        const token = jwt.sign(user, secretOrKey, { expiresIn });  
        return {  
            expires_in: expiresIn,  
            access_token: token,  
        };  
   }  

   async validateUser(payload: { email: string; password: string }): Promise<boolean> {  
        const user = await this.userService.findOne({  
            where: { email: payload.email }  
        });  
        return !!user;  
   }  
}

The service injects the UserService in order to find the user using the payload pass to the validateUsermethod. If the email in the payload allows you to find the user, and if that user has a valid token, she can continue the authentication process.

In order to provide a token for the user who try to logged in, implement the createToken method, which takes as parameters an email and an optional ttl. The ttl (Time to live) will configure the token to be valid for a period. The value of the ttl is expressed in seconds, and the default value that we have defined in 60 * 60, which means 1 hour.

Authentication controller

In order to process the authentication of the user, implement the controller and provide a handler for the login endpoint.

@Controller()  
export class AuthenticationController {  
   constructor(  
        private readonly authenticationService: AuthenticationService,  
        private readonly userService: UserService) {}  

   @Post('login')  
   @HttpCode(HttpStatus.OK)  
   public async login(@Body() body: any, @Res() res): Promise<any> {  
       if (!body.email || !body.password) {  
           return res.status(HttpStatus.BAD_REQUEST).send('Missing email or password.');  
       }  

       const user = await this.userService.findOne({  
           where: {  
               email: body.email,  
                password: crypto.createHmac('sha256', body.password).digest('hex')  
           }  
       });  
       if (!user) {  
           return res.status(HttpStatus.NOT_FOUND).send('No user found with this email and password.');  
       }  

       const result = this.authenticationService.createToken(user.email);  
       return res.json(result);  
    }  
}

The controller provides the login handler, which is accessible by a call on the POST /login route. The purpose of this method is to validate the credentials provided by the user in order to find him in the database. If the user is found, create the appropriate token that will be returned as a response with the expiresInvalue corresponding to our previously defined ttl. Otherwise the request will be rejected.

Module

We have now defined our service and strategy in order to configure passport and provide some method to create a token and validate a payload. Let’s define AuthenticationModule, which is similar to the following example.

@Module({})  
export class AuthenticationModule {  
   static forRoot(strategy?: 'jwt' | 'OAuth' | 'Facebook'): DynamicModule {  
       strategy = strategy ? strategy : 'jwt';  
        const strategyProvider = {  
            provide: 'Strategy',  
            useFactory: async (authenticationService: AuthenticationService) => {  
                const Strategy = (await import (`./passports/${strategy}.strategy`)).default;  
                return new Strategy(authenticationService);  
            },  
            inject: [AuthenticationService]  
       };  
        return {  
            module: AuthenticationModule,  
            imports: [UserModule],  
            controllers: [AuthenticationController],  
            providers: [AuthenticationService, strategyProvider],  
            exports: [strategyProvider]  
        };  
    }  
}

As you can see, the module is not defined as a normal module, so it has no components or controller defined in the @Module() decorator. In fact, this module is a dynamic module. In order to provide a multiple strategy, we can implement a static method on the class in order to call it when we import the module in another one. This method forRoot takes as a parameter the name of the strategy that you want to use and will create a strategyProvider in order to be added to the components list in the returned module. This provider will instanciate the strategy and provide the AuthenticationService as a dependency.

Let’s continue by creating something to protect, such as the UserModule.

User service

Let’s examine an example of the UserService and some methods in order to access and manipulate the data. All of the methods describe in this part will be used in the controller, and some of them are restricted by the authentication.

@Injectable()
export class UserService() {
    // The SequelizeInstance come from the DatabaseModule have a look to the Sequelize chapter
    constructor(@Inject('UserRepository') private readonly UserRepository: typeof User,
                @Inject('SequelizeInstance') private readonly sequelizeInstance) { }

    /* ... */
}

The service injects the UserRepository that we have described in the Sequelize chapter in order to access the model and the data store in the database. We also inject the SequelizeInstance, also described in the Sequelize chapter, in order to use the transaction.

The UserService implements the findOne method to find a user with a criteria passing in the options parameter. The options parameter can look like this:

{
    where: {
        email: 'some@email.test',
        firstName: 'someFirstName'
    }
}

Using this criteria, we can find the corresponding user. This method will return only one result.

@Injectable()
export class UserService() {
    /* ... */

    public async findOne(options?: object): Promise<User | null> {  
        return await this.UserRepository.findOne<User>(options);  
    }

    /* ... */
}

Let’s implement the findById method, which takes as a parameter an ID in order to find a unique user.

@Injectable()
export class UserService() {
    /* ... */

    public async findById(id: number): Promise<User | null> {  
        return await this.UserRepository.findById<User>(id);  
    }  

    /* ... */
}

Then we need a way to create a new user in the database passing the user respecting the IUser interface. This method, as you can see, uses a this.sequelizeInstance.transaction transaction to avoid reading the data before everything is finished. This method passes a parameter to the create function, which is returning in order to get the instance user that has been created.

@Injectable()
export class UserService() {
    /* ... */

    public async create(user: IUser): Promise<User> {  
        return await this.sequelizeInstance.transaction(async transaction => {  
            return await this.UserRepository.create<User>(user, {  
                returning: true,  
                transaction,  
            });  
        });  
    }  

    /* ... */
}

Of course, if you can create a user, you also need the possibility to update it with the following method following the IUser interface. This method too will return the instance of the user that has been updated.

@Injectable()
export class UserService() {
    /* ... */

    public async update(id: number, newValue: IUser): Promise<User | null> {  
        return await this.sequelizeInstance.transaction(async transaction => {  
            let user = await this.UserRepository.findById<User>(id, { transaction });  
            if (!user) throw new Error('The user was not found.');  

            user = this._assign(user, newValue);  
            return await user.save({  
                returning: true,  
                transaction,  
            });  
        });  
    }  

    /* ... */
}

In order to make a round in all of the methods, we will implement the delete method to remove a user completely from the database.

@Injectable()
export class UserService() {
    /* ... */

    public async delete(id: number): Promise<void> {  
        return await this.sequelizeInstance.transaction(async transaction => {  
            return await this.UserRepository.destroy({  
                where: { id },  
                transaction,  
            });  
        });  
    }

    /* ... */
}

In all of the previous examples, we have define a complete UserService that allowed us to manipulate the data. We have the possibility to create, read, update, and delete a user.

User model

If you wish to see the implementation of the user model, you can refer to the Sequelize chapter.

User controller

Now that we have created our service and model, we need to implement the controller to handle all the requests from the client. This controller provides at least a create, read, update and delete handler that should be implemented like the following example.

@Controller()  
export class UserController {  
   constructor(private readonly userService: UserService) { }

   /* ... */
}

The controller injects the UserService in order to use the methods implemented in the UserService.

Provide a GET users route that allows access to all users from the database, and you will see how we don’t want the user accessing the data of all of the users, just only for himself. This is why we are using a guard that only allows a user to acces his own data.

@Controller()  
export class UserController {  
    /* ... */

    @Get('users')  
    @UseGuards(CheckLoggedInUserGuard)
    public async index(@Res() res) {  
        const users = await this.userService.findAll();  
        return res.status(HttpStatus.OK).json(users);  
    }

    /* ... */
}

The user has access to a route that allows you to create a new user. Of course, if you want, the user can register into the logged in application, which we must allow for those without a restriction.

@Controller()  
export class UserController {  
    /* ... */

    @Post('users')  
    public async create(@Body() body: any, @Res() res) {  
       if (!body || (body && Object.keys(body).length === 0)) throw new Error('Missing some information.');  

        await this.userService.create(body);  
        return res.status(HttpStatus.CREATED).send();  
    }  

    /* ... */
}

We also provide a GET users/:id route that allows you to get a user by his ID. Of course a logged in user should not be able to access the data from another user even from this route. This route is also protected by a guard in order to allow the user access to himself and not another user.

@Controller()  
export class UserController {  
    /* ... */

    @Get('users/:id')  
    @UseGuards(CheckLoggedInUserGuard)
    public async show(@Param() id: number, @Res() res) {  
       if (!id) throw new Error('Missing id.');  

        const user = await this.userService.findById(id);  
        return res.status(HttpStatus.OK).json(user);  
    }   

    /* ... */
}

A user can have the idea to update some of his own information, which is why we provide a way to update a user through the following PUT users/:id route. This route is also protected by a guard to avoid a user updating another user.

@Controller()  
export class UserController {  
    /* ... */
    @Put('users/:id')  
    @UseGuards(CheckLoggedInUserGuard)
    public async update(@Param() id: number, @Body() body: any, @Res() res) {  
       if (!id) throw new Error('Missing id.');  

        await this.userService.update(id, body);  
        return res.status(HttpStatus.OK).send();  
    }

Use deletion to finish the last handler. This route has to also be protected by a guard to avoid a user from deleting another user. The only user that can be deleted by a user is himself.

    @Delete('users/:id')  
    @UseGuards(CheckLoggedInUserGuard)
    public async delete(@Param() id: number, @Res() res) {  
       if (!id) throw new Error('Missing id.');  

        await this.userService.delete(id);  
        return res.status(HttpStatus.OK).send();  
    }  
}

We have implemented all of the methods that we need in this controller. Some of them are restricted by a guard in order to apply some security and avoid a user from manipulating the data from another user.

Module

To finish the implementation of the UserModule, we have to set up the module of course. This module contains a service, a controller, and a provider that allows you to inject the user model and provides a way to manipulate the stored data.

@Module({  
    imports: [],  
    controllers: [UserController],  
    providers: [userProvider, UserService],
    exports: [UserService]  
})  
export class UserModule {}

This module is imported like the AuthenticationModule into the main AppModule in order to use it in the app and be accessible.